Structured confidence perturbation adversarial training based on Fisher geometry

AI summaryTo address "pseudo-attacks" in adversarial training that push up loss without changing the confidence structure, researchers propose a mixed objective of cross-entropy and KL divergence, and generate perturbations on the confidence manifold that maximize distributional distance. Theoretical analysis shows that the optimal perturbation direction is consistent with the principal eigenvector of the Fisher information matrix. Experiments on multiple datasets and model architectures show that the method's adversarial robustness and robust transferability outperform existing methods, and it is especially good at structured perturbations within high-confidence regions.