CAT: Customized Adversarial Training Improves Neural Network Robustness

1. 01What problem does this paper attempt to solve?

   The authors believe that adversarial training's fixed perturbation radius and one-hot label assumptions harm generalization, and propose CAT, which customizes perturbation and label per sample.

   Core problem: Standard adversarial training assumes all samples share a fixed large perturbation radius ε and fits one-hot labels; the authors argue that this assumption leads to unsatisfactory both clean and robust accuracy.

   • Problem setting: Adversarial training is the mainstream method for improving the adversarial robustness of neural networks, but the authors point out that its generalization on both clean data and perturbed data is poor, with a known robustness-accuracy trade-off (the paper cites Su et al., 2018; Tsipras et al., 2019).
   • Shortcomings of existing methods: The authors state that a uniform large ε causes the classifier to give up on samples near the decision boundary, distorting the decision surface (the linearly separable example in Figure 1); and forcing the output to be a one-hot label after a large perturbation is unreasonable—when a sample is perturbed to the boundary, the ideal output should be [0.5, 0.5]. Existing work (Ding et al., 2018; Balaji et al., 2019) only addressed the non-uniformity of ε, without combining customized labels.
   • Core observation: Table 1 shows that on CIFAR-10 VGG-16, when trained with ε=0.03, the training error is near zero but the test robust accuracy drops to 66.04% (69.79% when trained with ε=0.01); based on this, the authors argue that a uniform large ε increases the generalization gap even if the training error is perfect.
   • Method proposed in the paper: Customized Adversarial Training (CAT), which dynamically adjusts the perturbation strength εi and the corresponding target label for each sample during training, and provides a generalization theoretical analysis; the authors state that the additional computational overhead is negligible.
   • Threat model:
     • Attacker goal: apply perturbations to inputs at test time to cause the model to misclassify (non-targeted attack).
     • Perturbation constraint: l∞ norm ball, standard evaluation radius 8/255.
     • Attacker knowledge: evaluation covers white-box attacks (PGD, C&W) and black-box transfer attacks (adversarial examples generated from a natural model transferred to the target model).
     • Victim system: VGG-16, Wide ResNet on CIFAR-10, and ResNet-50 image classifiers on Restricted-ImageNet.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into three groups: adversarial attacks, improvements to adversarial training, and other defenses; the baselines are Madry adversarial training and TRADES, and numerical comparisons are also made with 7 methods.

   Adversarial attacks

   • Gradient-based white-box attacks: FGSM (Goodfellow et al., 2015), C&W (Carlini & Wagner, 2017), PGD (Madry et al., 2018).
   • Black-box attacks: soft-label (Chen et al., 2017; Ilyas et al., 2018) and hard-label (Brendel et al., 2017; Cheng et al., 2018; 2020) settings, which the paper says are close in quality to white-box attacks; there are also physical attacks (Eykholt et al., 2018).

   Adversarial training and its improvements

   • Goodfellow et al. (2015) used FGSM samples for data augmentation; Kurakin et al. (2017) used multi-step FGSM; Madry et al. (2018) formalized adversarial training as a min-max problem and used PGD to solve the inner maximization.
   • TRADES (Zhang et al., 2019b) minimizes a theoretical upper bound and won first place in the NeurIPS 2018 defense competition; Ding et al. (2018) distinguish correctly and incorrectly classified samples (MMA); Wang (2020) combines both types of samples using predicted-probability smoothing (MART); Wang (2019) simultaneously searches for adversarial perturbations and adversarial labels (Bilateral Adv Training).
   • Work on accelerating adversarial training: Shafahi et al. (2019), Zhang et al. (2019a), Wong et al. (2020). The paper notes that current defense models are still not ideal, and both clean and robust error have room for improvement.

   Other defenses

   • Gaussian data augmentation (Zantedeschi et al., 2017), randomized smoothing (Liu et al., 2018; Cohen et al., 2019), Mixup and its variants (Zhang et al., 2018 et al.), label smoothing (Shafahi et al., 2018; Goibert & Dohmatob, 2019).
   • The paper notes that some of these methods have been shown to cause only gradient obfuscation rather than true robustness (Athalye et al., 2018), whereas adversarial training methods are still shown to be robust under different attacks.

   Baselines and comparison setup

   • Baseline methods directly compared: Adversarial training (Madry et al., 2018), TRADES, Natural training; on the standard CIFAR-10 + Wide ResNet setting, the paper also compares its reported numbers with 7 published methods (Dynamic adversarial training, Bilateral Adv Training, MMA, MART, IAAT, etc.) (Table 3).

   Positioning of this paper: The authors say MMA and IAAT likewise have sample-level adaptive ε but do not consider adaptive labels, and can only improve clean accuracy while robust accuracy improves only limitedly; CAT-CE degenerates to IAAT when c=0, and MMA can be regarded as a special case of CAT-CE with line search and c=0 (Section 3.6).

   Collapse this answer

3. 03How does the paper address this problem?

   CAT alternately updates the sample-level perturbation radius εi and the model parameters, and performs adaptive smoothing on the labels according to εi, with an optional mixed loss.

   Overall idea: change the fixed ε maximized in the inner loop of adversarial training to a per-sample adaptive εi, and replace the one-hot label with a target label that becomes smoother as εi increases, forming Customized Adversarial Training (CAT).

   Problem formulation

   • Standard adversarial training is a min-max problem: min_θ 1/n∑_i max_{x′i ∈ B(xi, ϵ)} ℓ(f_θ(x′_i), y_i), i.e., find the adversarial sample with the largest loss within the ε ball and then minimize the loss; this paper uses the l∞ ball.
   • The inner maximization has no closed-form solution and is approximately solved with multi-step PGD.

   Sample-level adaptive ε (Section 3.3)

   • The ideal definition is to take, for each sample, the maximum εi that makes the attack just fail (Equation (2)); exact solution requires brute-force search, so the authors use a simplified update rule.
   • Update rule: εi starts from 0, and each round runs a PGD attack with εi+η; if the attack succeeds, εi is kept; if it fails, εi is increased by η; the attack result is also used to update the model parameters, so there is almost no additional overhead; εi is capped at εmax.

   Adaptive label uncertainty (Section 3.4)

   • Bind label smoothing to εi: ỹ_i = (1 − cϵ_i)y_i + cϵ_i Dirichlet(1), i.e., the greater the perturbation tolerance, the higher the label uncertainty, with c as a hyperparameter; Dirichlet(1) sampling is used instead of a uniform distribution to prevent overfitting.
   • The authors argue that non-uniform εi introduces different biases into the loss, which may be one reason why pure adaptive ε methods perform poorly.

   Loss functions and algorithm flow

   • CAT-CE uses cross-entropy; CAT-MIX adds a C&W-type margin term max{max_{i≠y0}[Z(x)]i − [Z(x)]y0, −κ} on top of cross-entropy; the authors state that models trained with the smoothing technique defend better against PGD than against C&W∞, so a mixed loss is used to enhance defense against C&W∞.
   • Algorithm 1: each round first temporarily sets εi←εi+η, runs m steps of PGD (sign gradient, projected to [−εi, εi]); if the resulting sample is misclassified, εi is reverted by η, then truncated at εmax, the smoothed label is recomputed, and one step of SGD is performed.
   • Key hyperparameters (Section 4.1): 10 attack iterations, η=0.005, εmax=8/255, c=10, κ=10 for CAT-MIX; SGD momentum 0.9, weight decay 5×10⁻⁴.

   Theoretical analysis (Section 3.5)

   • Defines the bilateral margin (Definition 3.1): the minimum norm required to perturb both the input layer and the softmax output simultaneously to cause misclassification.
   • Theorem 3.2 (adapted from Wei & Ma, 2019): the population risk is controlled by the reciprocal of the average margin and the covering number of the parameter space; based on this, the authors explain the need to account for the margins of boundary samples, and assume that adaptive ε brings implicit regularization.
   • The authors report a rough measure of model complexity using the product of the weight norms of each layer: models trained with fixed ε=0.01, 0.02, 0.03 have C values 2.54, 3.53, 1.39 times that of the CAT model, respectively.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On CIFAR-10, CAT-CE achieves 93.48% clean and 73.38% PGD, higher than the 7 comparison methods; transfer attacks and ablations support the design.

   Experimental setup

   • Evaluated models: VGG-16 and Wide ResNet on CIFAR-10 (same architecture as Madry et al., 2018; Zhang et al., 2019b); ResNet-50 on Restricted-ImageNet (results in the appendix, the main text gives no numbers).
   • Datasets: CIFAR-10 and Restricted-ImageNet; the paper does not specify the sample size used.
   • Baselines: Adversarial training (Madry et al., 2018), TRADES, Natural training; under the Wide ResNet standard setting, numbers reported in the papers of 7 additional methods are collected (Dynamic adversarial training, Bilateral Adv Training, MMA, MART, IAAT, etc.).
   • Training setup: all methods use 10 attack iterations; adversarial training and TRADES use PGD, ε=8/255, CE loss; CAT sets εmax=8/255, η=0.005, c=10, and κ=10 for CAT-MIX.
   • Evaluation method: white-box l∞ non-targeted PGD20 (20 steps, step size ε/5) and C&W∞, both with random-start; when ε=0, robust accuracy is clean accuracy; transfer attacks follow the criteria of Athalye et al. (2018), generating 10,000 CIFAR-10 adversarial examples (ε=0.03) from a natural model to attack the target model.
   • Number of repetitions: not reported in the paper.

   Main results

   Table 3: CIFAR-10 + Wide ResNet, robust accuracy all evaluated under the 8/255 l∞ ball, (∗) indicates the test attack uses random-restart, (20) indicates 20-step PGD.

   Swipe horizontally to read the table

   Method	Clean	PGD	C&W
   Natural training	95.93%	0%	0%
   Adversarial training (Madry et al., 2018)	87.30%	52.68%	50.73%
   TRADES (Zhang et al., 2019b)	84.22%	56.40%(20)	51.98%
   Bilateral Adv Training (Wang, 2019)	91.00%	57.5%(∗20)	56.2%(∗20)
   MART (Wang, 2020)	84.17%	58.56%(20)	54.58%
   IAAT (Balaji et al., 2019)	91.34%	48.53%(∗10)	56.80%
   CAT-CE (ours)	93.48%	73.38%(∗20)	61.88%(∗20)
   CAT-MIX (ours)	89.61%	73.16%(∗20)	71.67%(∗20)

   According to Table 3 (the two rows for Dynamic adversarial training and MMA are omitted: the C&W column for MMA in the original text is an illegible symbol).

   • The authors state that CAT achieves the best robust accuracy under this setting while maintaining high clean accuracy; the comparison given in the abstract is CAT 73%/71% (PGD/C&W) versus 58.6%/56.8% for the then-best model.
   • Note that the attack settings of the comparison methods are not entirely consistent (the number of steps and random-restart markers differ), and the numbers are the best values reported in each paper.
   • Figure 2 shows that on VGG and Wide ResNet, over the ε range from 0 to 0.07, the CAT-CE and CAT-MIX curves lie above TRADES, adversarial training, and Natural (per the authors); the converted text cannot read the specific curve values.

   Black-box transfer attacks (Table 4)

   • What was tested: generate 10,000 adversarial examples (ε=0.03) from a natural model to transfer-attack each defense model, checking for gradient obfuscation.
   • Results: on VGG-16, Adv train 79.13%, TRADES 83.53%, CAT 86.58%; on Wide ResNet, 85.84%, 83.90%, 88.66%, respectively.
   • Authors' interpretation: CAT is the most effective under both white-box and transfer attacks, indicating that the robustness does not come from gradient obfuscation.

   Ablation and attack strength analysis (Figure 4)

   • Importance of adaptive labels: Figure 4b compares Adv train, Adv+LS (with label smoothing), Adp-Adv (adaptive ε only), and CAT-CE on VGG-16/CIFAR-10; the authors state that using adaptive ε or label smoothing alone cannot significantly improve robust accuracy, and only the combination is effective, and on this basis explain why CAT outperforms IAAT and MMA; the converted text cannot read the values of each bar.
   • More PGD iterations: Figure 4a increases PGD iterations from 10 to 500 on VGG-16; the authors state that increasing iterations decreases accuracy by about 2%, but CAT consistently outperforms other methods.
   • Loss landscape: Figure 3 visualizes the loss surface following Engstrom et al. (2018); the authors state that CAT's loss surface is lower and smoother; the converted text only shows the axis ticks and cannot verify the surface shape.

   Other analyses

   • Model complexity: roughly measured by the product of the weight norms of each layer, models trained with fixed ε=0.01, 0.02, 0.03 are 2.54, 3.53, 1.39 times that of CAT, respectively (Section 3.5); based on this, the authors argue that CAT has stronger implicit regularization.
   • Negative result: Table 1 shows that when trained with a fixed large ε (0.03), the test robust accuracy (66.04%) is lower than when trained with ε=0.01 (69.79%), even though the training error is near zero; this is the evidence in the motivation section of the paper.

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not specifically discuss limitations; the experiments are limited to l∞ attack evaluation on CIFAR-10 and Restricted-ImageNet.

   Limitations and future directions noted by the authors

   • The paper does not specifically discuss limitations, and there is no Limitations or Future Work section; the Conclusion only summarizes the method and states that CAT maintains a runtime similar to standard adversarial training.

   Scope of experimental coverage

   • The evaluated models are VGG-16, Wide ResNet (CIFAR-10), and ResNet-50 (Restricted-ImageNet), 3 in total; the Restricted-ImageNet results are placed in the appendix, the main text gives no numbers, and the converted text does not include that appendix table.
   • Attack evaluation covers white-box PGD20, C&W∞ (both with random-start), and transfer attacks from a natural model (10,000 samples, ε=0.03); the threat model is l∞ norm-bounded perturbation, and the standard radius for training and evaluation is 8/255.
   • In the main results table (Table 3), the numbers for comparison methods come from the values reported in their respective papers, and the attack steps and random-restart settings are not entirely consistent (e.g., IAAT is (∗10), MART is (20)).
   • The paper does not report the number of repetitions and variance for each experiment, nor does it report human evaluation.
   • Regarding efficiency, the authors state that CAT is comparable in speed to original adversarial training and the additional overhead is negligible; the paper does not report specific training time numbers.

   Collapse this answer

6. 06Summarize the main content of the paper

   CAT customizes the perturbation radius and label per sample; on CIFAR-10 Wide ResNet, PGD 73.38%, clean 93.48%.

   A paper on improving adversarial training: addressing the assumptions of standard adversarial training that all samples use a fixed large perturbation radius and fit one-hot labels, the authors propose Customized Adversarial Training (CAT).

   • Problem: The authors believe a uniform large ε makes the classifier give up on boundary samples and distorts the decision surface, and that forcing one-hot outputs after large perturbations is unreasonable, making it difficult to improve both clean and robust accuracy.
   • Method: During training, whether the PGD attack succeeds is used as a signal to adaptively adjust each sample's εi (step size η=0.005, upper limit 8/255), and the target labels are smoothed with Dirichlet(1) according to the magnitude of εi (c=10); CAT-MIX additionally adds a C&W-type margin term (κ=10). A generalization bound adapted from Wei & Ma (2019) links risk to the two-sided margin and model complexity.
   • Main results (CIFAR-10, Wide ResNet, 8/255 l∞, Table 3): CAT-CE achieves 93.48% clean accuracy, 73.38% PGD(∗20), 61.88% C&W(∗20); CAT-MIX's C&W is 71.67%. Among comparison methods, the highest PGD is MART's 58.56%, and the highest clean accuracy is IAAT's 91.34%.
   • Transfer attacks (Table 4): CAT achieves 86.58% and 88.66% on VGG-16 and Wide ResNet respectively, higher than adversarial training and TRADES, on which basis the authors argue the robustness is not gradient obfuscation.
   • Ablation (Figure 4): The authors say that adaptive ε or label smoothing alone cannot significantly improve robust accuracy, and only the combination is effective; when PGD iterations increase to 500, accuracy drops by about 2%, and CAT still outperforms other methods.
   • Authors' conclusion: Customizing perturbation strength and labels per sample in adversarial training is key to improving clean and robust performance, and the computational cost is comparable to standard adversarial training.

   Collapse this answer

Related papers