robustness

This study investigates the trade-off between adversarial robustness and distributional robustness, revealing that adversarial training may inadvertently amplify a model’s reliance on spurious features, thereby degrading performance on minority subpopulations. By developing a theoretical framework on perturbed data and integrating measures of feature separability with robustness evaluation metrics, the work elucidates how each step of adversarial training influences distributional robustness. The analysis shows that ℓ∞ adversarial perturbations can enhance distributional robustness on moderately biased datasets; this benefit persists even under high data skew when the model’s simplicity bias leads it to focus on core features. These findings underscore the pivotal role of feature separability in mediating the trade-off between the two forms of robustness, cautioning against misjudging robustness outcomes when this factor is overlooked.

This work investigates the root causes of adversarial examples and the mechanism by which adversarial training enhances model robustness. Standard training tends to learn dense yet non-robust features, compromising generalization under perturbations. Method: Under a structured data assumption, we propose a feature learning theoretical framework based on a two-layer smooth ReLU CNN; adversarial training (PGD-style) alternates gradient ascent to generate adversarial examples and gradient descent for optimization. Contribution/Results: We provide the first theoretical characterization of the learnability separation between robust and non-robust features, rigorously proving that PGD-based adversarial training promotes robust feature learning while suppressing non-robust feature learning—revealing an intrinsic link between feature robustness and adversarial perturbation directions. Our analysis combines feature disentanglement with generalization error bounds. Theoretically guaranteed robustness improvement is empirically validated on MNIST, CIFAR-10, and SVHN, confirming the predicted feature selection mechanism.

Adversarial training, while enhancing model robustness, exacerbates inter-class robustness imbalance and degrades clean-sample generalization. To address this, we propose a class-aware augmentation labeling mechanism that integrates fine-grained class information into adversarial training, jointly optimizing per-class accuracy and robustness on both clean and adversarial examples. Our method is the first to systematically characterize the “spillover effect” of adversarial training—where robustness gains for some classes inadvertently widen inter-class robustness disparities—and introduces a unified robustness-accuracy evaluation framework. Experiments demonstrate a 53.50% improvement in overall adversarial robustness, a 5.73% reduction in inter-class performance imbalance, and a statistically significant gain in clean-sample accuracy. The approach thus simultaneously advances robustness, generalization, and fairness across classes.

This work addresses robust overfitting in adversarial training, identifying excessive model confidence—i.e., high predictive certainty—on adversarial examples as a key cause of degraded robust generalization. To this end, we formally introduce the concept of *adversarial certainty*, defined as the variance of logits on adversarial samples, and establish its theoretical connection to robust generalization performance. Building upon this insight, we propose a generic robust optimization framework that actively reduces adversarial certainty during training without compromising clean classification discriminability. Extensive experiments across multiple image classification benchmarks demonstrate that our method significantly improves robust accuracy and effectively mitigates robust overfitting. These results empirically validate that explicitly controlling adversarial uncertainty is crucial for enhancing robust generalization.

This work investigates fundamental limitations on the generalization of robust classifiers: even when an accurate robust solution exists, learning a high-accuracy robust classifier requires exponentially many samples. We establish, for the first time, a rigorous exponential lower bound on the sample complexity of robust generalization within the PAC learning and information-theoretic frameworks. Our analysis identifies the root cause as the decoupling between exploitability of non-robust and robust features—not insufficient model capacity. Through PGD-based adversarial training, feature separability analysis, and empirical evaluation on CIFAR-10, we demonstrate that robust accuracy grows extremely slowly with increasing data size, while standard architectures already possess sufficient capacity to represent robust features. The core contribution is the identification of *data inefficiency*—not architectural or optimization limitations—as the fundamental bottleneck in robust learning, thereby laying a new theoretical foundation for robustness research.

This study investigates the relationship between the robustness of neural networks under random input perturbations and their prediction accuracy, measured by mean squared error (MSE). To address this, the work proposes an efficient, computable black-box robustness metric that, without requiring access to internal model architecture, provides a high-probability upper bound on the network’s MSE over an entire dataset under a given perturbation. The method innovatively introduces robustness curves, enabling systematic comparison and analysis of robustness across different datasets. Experimental evaluations on multiple real-world datasets demonstrate that the proposed approach accurately quantifies and effectively captures a model’s sensitivity to input noise, offering a practical tool for assessing robustness in diverse settings.

Deep learning models exhibit insufficient robustness against adversarial perturbations and common image corruptions, undermining their reliability in real-world deployment. To address this, we propose an active robustness verification strategy that leverages the training set itself: by performing local robustness analysis, our method automatically identifies “weakly robust” samples—serving as early, interpretable indicators of model vulnerability—and enables targeted robustness enhancement. Unlike conventional passive paradigms that rely solely on perturbed test sets for robustness evaluation, ours is the first to repurpose training data for robustness diagnostics. We integrate adversarial perturbation injection with diverse natural corruption tests. Extensive experiments on CIFAR-10, CIFAR-100, and ImageNet demonstrate that our strategy significantly improves model robustness against both attacks and corruptions (average gain of +8.2%) while enhancing the sensitivity and interpretability of reliability assessment.

Prior research on probabilistic robustness (PR) lacks standardized evaluation protocols and strong baselines, hindering fair comparison and progress. Method: We introduce PRBench—the first dedicated benchmark for PR—comprising seven datasets and ten model architectures, enabling systematic evaluation of 222 models across clean accuracy, adversarial robustness (AR), probabilistic robustness (PR), and generalization error. We propose a unified evaluation framework and theoretical analysis to rigorously assess PR performance. Contribution/Results: Our analysis reveals that standard adversarial training (AT), traditionally considered suboptimal for PR, consistently outperforms existing PR-specific methods across most settings. AT achieves superior robustness and generalization, whereas PR methods—though attaining marginally higher clean accuracy and lower generalization error—exhibit constrained overall PR performance. PRBench provides a reproducible, standardized platform for future PR research, facilitating transparent benchmarking and methodological advancement.

This work addresses the challenge of enhancing the adversarial robustness of non-robust pre-trained models on a target distribution using only a small amount of unlabeled target data at test time. To this end, the authors propose an unsupervised test-time adaptation framework that leverages predictions from a non-robust teacher model to construct semantic anchors, replacing conventional self-consistency constraints. The method jointly optimizes objectives for both clean and adversarial examples and is supported by theoretical analysis demonstrating its improved stability. Integrating adversarial training, knowledge distillation, and unsupervised learning, the approach is validated on CIFAR-10 and ImageNet under photometric perturbations, exhibiting superior optimization stability, reduced sensitivity to hyperparameters, and a better trade-off between robustness and accuracy.

This work investigates the extent to which adversarial attacks reflect a model’s actual robustness under random noise of comparable magnitude, rather than merely characterizing worst-case scenarios. To this end, the authors propose a directional bias perturbation framework governed by a concentration parameter κ, which interpolates smoothly between isotropic noise and adversarial directions. They further introduce a novel attack strategy designed to better approximate realistic statistical noise. Through systematic evaluations on ImageNet and CIFAR-10, the study delineates the conditions under which common adversarial attacks effectively capture noise-induced failure risks, thereby offering both theoretical grounding and practical guidance for safety-oriented robustness evaluation of machine learning models.