Improving Adversarial Robustness via Activation Amplification and Attenuation

2026-06-26

AI Summary

Existing defense methods struggle to effectively enhance the adversarial robustness of neural networks without compromising efficiency. This work proposes Activation Amplification and Attenuation (A3), a lightweight, plug-and-play mechanism that dynamically modulates activations in both directions through learnable masks and scaling factors sharing parameters. In amplification mode, A3 generates negative reference signals to construct contrastive and ranking losses; in attenuation mode, it boosts robustness. Notably, A3 is the first to exploit performance degradation caused by amplification as a supervisory signal, achieving substantial robustness gains with minimal additional parameters. Evaluated across diverse backbone architectures, datasets, and training protocols, A3 consistently improves robustness while incurring significantly lower computational and memory overhead than existing plug-in approaches.

Abstract

The existence of adversarial attacks is often attributed to the presence of non-robust features in neural networks. While prior defenses reduce their impact via pruning, masking, or feature recalibration, we instead propose to jointly learn to amplify and attenuate these signals through a simple activation scaling mechanism. To this end, we introduce Activation Amplification and Attenuation (A3), a lightweight plug-in module that enhances adversarial robustness with minimal modifications of the activations. A3 dynamically rescales the activations using a learnable mask and a scaling factor derived from the original activation magnitudes. The influence of adversarial perturbations can be amplified or attenuated using the same learnable parameters by simply flipping the sign of the scaling operation. The amplified signals serve as negative references to construct novel contrastive and ranking loss functions. Experimental analysis shows that learning to degrade the predictions in amplification mode simultaneously improves adversarial robustness in attenuation mode. Moreover, A3 relies on only a small number of learnable parameters, with most of its behavior being determined by the scaling mechanism rather than additional network capacity. Extensive experiments demonstrate that integrating A3 into different backbones, datasets, and training methods consistently improves adversarial robustness while introducing negligible computational and memory overhead compared to existing plug-in modules. Code is available at: https://github.com/tgoncalv/A3.

Problem

• adversarial robustness
• non-robust features
• adversarial attacks
• activation scaling

Innovation

• Activation Amplification and Attenuation
• adversarial robustness
• activation scaling
• contrastive loss
• plug-in module