[Paper Review] Recent Advances in Adversarial Training for Adversarial Robustness

Tao Bai, Jinqi Luo+3 more|arXiv (Cornell University)|Feb 2, 2021

Adversarial Robustness in Machine Learning79 references43 citations

TL;DR

This survey reviews recent advances in adversarial training (AT) for improving adversarial robustness, presenting a novel taxonomy, discussing generalization challenges, and outlining future directions.

ABSTRACT

Adversarial training is one of the most effective approaches defending against adversarial examples for deep learning models. Unlike other defense strategies, adversarial training aims to promote the robustness of models intrinsically. During the last few years, adversarial training has been studied and discussed from various aspects. A variety of improvements and developments of adversarial training are proposed, which were, however, neglected in existing surveys. For the first time in this survey, we systematically review the recent progress on adversarial training for adversarial robustness with a novel taxonomy. Then we discuss the generalization problems in adversarial training from three perspectives. Finally, we highlight the challenges which are not fully tackled and present potential future directions.

Motivation & Objective

• Provide an up-to-date overview of adversarial training methods and how they improve robustness.
• Introduce a novel taxonomy of AT approaches and relate them to robustness gains.
• Discuss generalization gaps in AT and identify challenges and future research directions.

Proposed method

• Review and categorize recent AT methods into a structured taxonomy (adversarial regularization, curriculum, ensemble, adaptive epsilon, semi/unsupervised, efficient training, and other variants).
• Summarize experimental results from Table 1 to compare robustness-performance trade-offs across methods and datasets.
• Discuss generalization problems in standard accuracy, adversarial robustness, and unseen attacks.
• Highlight theoretical and practical challenges in min-max optimization and generalization, and suggest directions beyond AT.

Experimental results

Research questions

• RQ1 What are the key families of adversarial training methods and how do they differ in formulation and targets?
• RQ2 How do recent AT methods perform across datasets and attacks, and what generalization gaps remain?
• RQ3 What are the main limitations of current AT approaches (e.g., min-max optimization, overfitting, unseen attacks) and potential directions beyond AT?

Key findings

• Adversarial training remains the most effective defense, but accuracy under adversarial evaluation remains substantially lower than clean accuracy on many datasets.
• A wide variety of AT methods exist (regularization, curriculum, ensemble, adaptive epsilon, semi/unsupervised, efficient training) with differing trade-offs between robustness and standard accuracy.
• Generalization gaps (adversarially robust generalization and generalization to unseen attacks) are persistent and not fully solved by current AT techniques.
• Current practice often relies on PGD-based inner optimization, which provides no formal robustness certificate and can be computationally intensive.
• Semi/unsupervised data can reduce sample complexity gaps and improve robustness, though guarantees are still limited.
• Efforts to speed up AT (e.g., Free-AT, FAST-AT, YOPO) help reduce training time but can introduce issues like catastrophic overfitting unless mitigated.