Dynamic Dual-level Defense Routing for Continual Adversarial Training

2025-09-23

AI Summary

To address catastrophic forgetting of defense models in continual adversarial training (CAT), this paper proposes the Dynamic Dual-layer Defense Routing framework (DDeR). DDeR employs a dual-layer routing mechanism coupled with an Adversarial Sentinel Network (ASN) to enable attack-adaptive selection of specialized experts. It further introduces Pseudo-Task Substitution Training (PST), a novel strategy that supports dynamic, incremental router expansion and cross-task knowledge coordination—without requiring historical data storage. Unlike existing approaches relying on data replay or parameter regularization, DDeR effectively mitigates adversarial knowledge forgetting. As a result, it significantly improves defense stability and classification accuracy under continual adversarial attacks. Extensive experiments demonstrate that DDeR consistently outperforms state-of-the-art methods across multiple continual adversarial learning benchmarks.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

As adversarial attacks continue to evolve, defense models face the risk of recurrent vulnerabilities, underscoring the importance of continuous adversarial training (CAT). Existing CAT approaches typically balance decision boundaries by either data replay or optimization strategy to constrain shared model parameters. However, due to the diverse and aggressive nature of adversarial examples, these methods suffer from catastrophic forgetting of previous defense knowledge after continual learning. In this paper, we propose a novel framework, called Dual-level Defense Routing or DDeR, that can autonomously select appropriate routers to integrate specific defense experts, thereby adapting to evolving adversarial attacks. Concretely, the first-level defense routing comprises multiple defense experts and routers, with each router dynamically selecting and combining suitable experts to process attacked features. Routers are independently incremented as continuous adversarial training progresses, and their selections are guided by an Adversarial Sentinel Network (ASN) in the second-level defense routing. To compensate for the inability to test due to the independence of routers, we further present a Pseudo-task Substitution Training (PST) strategy, which leverages distributional discrepancy in data to facilitate inter-router communication without storing historical data. Extensive experiments demonstrate that DDeR achieves superior continuous defense performance and classification accuracy compared to existing methods.

Problem

• Addresses catastrophic forgetting in continual adversarial training
• Proposes dynamic router selection to integrate defense experts
• Enhances defense against evolving adversarial attack strategies

Innovation

• Dual-level routing autonomously selects defense experts
• Adversarial Sentinel Network guides router selection process
• Pseudo-task substitution enables inter-router communication without data storage