Skip to content
Original

Data augmentation-guided adversarial training based on local-stability sample selection (AGAT)

Augmentation-Guided Adversarial Training via Local Stability-Based Sample Selection

arXiv: Adversarial Attacks, Backdoors & Poisoning· arXiv:2610.33331· Daniel Agyei Asante, Mark Tetteh, Deborah Asamoah, Bernard Asante, Regina Esi TurksonIowa State University; Ohio University; University of Nebraska Omaha; University of Toronto; University of Cape CoastIndexed by this site · 17 days ago· Originally publishedDefenses

Translation in progress — untranslated text is omitted.

Quick read

Defenses

Based on the paper PDF (AI-generated); refer to the original

AI summaryThe paper proposes a selective adversarial training framework, AGAT, which applies adversarial supervision to only 20-30% of training samples per batch, with comparable or higher robust accuracy. It uses a lightweight score, ALS, to measure the normalized change in logits between an input and its label-preserving augmented variant, selecting neighborhood-unstable samples. On MNIST, CIFAR-10, CIFAR-100 and Tiny-ImageNet-200, its training time is lower than all adversarial training baselines.

Questions
Standard PGD adversarial training must generate adversarial examples for every training sample, which is computationally expensive; existing selective adversarial training uses pointwise difficulty signals such as loss, entropy, and margin to select samples, and the authors argue these signals cannot see local instability within a sample's neighborhood.
Methods
The authors propose AGAT: use IDBH labels to retain the augmented variants of the original samples in augmented generation, compute an ALS score from the normalized change in logits between the two, rank by ALS and select a proportion τ of samples in each minibatch for PGD adversarial training, with the remaining samples trained cleanly.
Experiments and results
On MNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet-200, AGAT perturbs only 20–30% of samples: robust accuracy on MNIST is close to Full PGD-AT, and higher on the other three datasets; training time is lower than all adversarial training baselines (Table 6).
Limitations and future work
The paper does not specifically discuss limitations. The experiments cover only two architectures and four image classification datasets, the evaluation attack is only PGD-50, the selection ratio was tested only at τ=20% and 30%, and no evaluation against adaptive attacks or other attacks is reported.

Related events and news

1 events · 0 news mentions

Related papers

Both use: CIFAR-100
Show 3 more papers
Both use: CIFAR-100
Read originalarxiv.org