[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-297222-105":59,"doc-detail-297222-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","are-labels-required-for-improving-adversarial-robustness","Are Labels Required for Improving Adversarial Robustness?","","Recent work shows that making models invariant to adversarial perturbations needs substantially more data than standard classification, limiting deployment where labeled data is costly. The paper argues unlabeled data can substitute: theoretically, unlabeled training matches supervised sample complexity up to constants. Experiments use a simple Unsupervised Adversarial Training (UAT) method, improving CIFAR-10 robust accuracy by 21.7% using only unlabeled data plus 4K labeled examples, and leveraging 80 Million Tiny Images for further gains.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/are-labels-required-for-improving-adversarial-robustness/297222/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/are-labels-required-for-improving-adversarial-robustness/297222.png","ImageObject",300,407,{"name":92,"@type":93},"McGucket","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-28","2026-09-18",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",15,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"Why are labeled datasets often required for adversarial robustness training?","Question",{"text":113,"@type":114},"Adversarial robustness training typically requires larger datasets than standard classification because models must be invariant to adversarial perturbations, which has higher sample demands in theory and practice.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How does the paper use unlabeled data to improve adversarial robustness?",{"text":118,"@type":114},"It proposes Unsupervised Adversarial Training (UAT), where unlabeled data is used to estimate the classifier’s smoothness around natural images and then combine this with limited labeled information to improve robustness.",{"name":120,"@type":111,"acceptedAnswer":121},"What experimental gains does UAT achieve?",{"text":122,"@type":114},"On CIFAR-10, UAT improves robust accuracy by 21.7% compared with using only 4K supervised examples, and captures over 95% of the improvement attainable with the same amount of labeled data. It also reports further improvement on CIFAR-10 using additional unlabeled data from 80 Million Tiny Images.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},297222,1789742794,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":52,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":144,"preview_page_count":4},1236954412713,"https://us-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Are Labels Required for Improving Adversarial Robustness?  \nJonathan Uesato⇤ Jean-Baptiste Alayrac⇤ Po-Sen Huang⇤  \nRobert Stanforth Alhussein Fawzi Pushmeet Kohli  \nDeepMind  \n{juesato,jalayrac,[posenhuang}@google.com](posenhuang}@google.com)  \nAbstract  \nRecent work has uncovered the interesting (and somewhat surprising) finding that training models to be invariant to adversarial perturbations requires substantially larger datasets than those required for standard classification. This result is a key hurdle in the deployment of robust machine learning models in many real world applications where labeled data is expensive. Our main insight is that unlabeled data can be a competitive alternative to labeled data for training adversarially robust models. Theoretically, we show that in a simple statistical setting, the sample complexity for learning an adversarially robust model from unlabeled data matches the fully supervised case up to constant factors. On standard datasets like CIFAR- 10, a simple Unsupervised Adversarial Training (UAT) approach using unlabeled data improves robust accuracy by 21.7% over using 4K supervised examples alone, and captures over 95% of the improvement from the same number of labeled examples. Finally, we report an improvement of 4% over the previous state-of-theart on CIFAR-10 against the strongest known attack by using additional unlabeled data from the uncurated 80 Million Tiny Images dataset. This demonstrates that our finding extends as well to the more realistic case where unlabeled data is also uncurated, therefore opening a new avenue for improving adversarial training.  \n1 Introduction  \nDeep learning has revolutionized many areas of research such as natural language processing, speech recognition or computer vision. System based on these techniques are now being developed and deployed for a wide variety of applications, from recommending/ranking content on the web [13, 22] to autonomous driving [7] and even in medical diagnostics [14] . The safety-critical nature of some of these tasks necessitates the need for ensuring that the deployed models are robust and generalize well to all sorts of variations that can occur in the inputs. Yet, it has been shown that the commonly used deep learning models are vulnerable to adversarial perturbations in the input [43], [e.g.](e.g. it)[ it](e.g. it) is possible to fool an image classifier into predicting arbitrary classes by carefully choosing perturbations imperceptible to the human eye.  \nSince the discovery of these results, many approaches have been developed to prevent this type of behaviour. One of the most effective and popular approaches is known as supervised adversarial training [17, 30] which works by generating adversarial samples in an online manner through an  \ninner optimization procedure and then using them to augment the standard training set. Despite *Equal contribution, random order.  \n†The authors declare that the present paper is independent of “Unlabeled Data Improves Adversarial Robustness” [10] .  \n33rd Conference on Neural Information Processing Systems (NeurIPS 2019), Vancouver, Canada.  \nsubstantial work in this space, accuracy of classifiers on adversarial inputs remains much lower than that on normal inputs. Recent theoretical work has offered a reason for this discrepancy, and argues that training models to be invariant to adversarial perturbations requires substantially larger datasets than those required for the standard classification task [41] .  \nThis result is a key hurdle in the development and deployment of robust machine learning models in many real world applications where labeled data is expensive. Our central hypothesis is that additional unlabeled examples may suffice for adversarial robustness. Intuitively, this is based on two related observations, explained in Sections 3 and 4.1.2. First, adversarial robustness depends on the smoothness of the classifier around natural images, which can be estimated from unlabeled","cbCaikVulZReeK8v","https://ap.wps.com/l/cbCaikVulZReeK8v","pdf",1356283,"English","# Introduction\n## Contributions\n# Experiment Results","[{\"question\":\"Why are labeled datasets often required for adversarial robustness training?\",\"answer\":\"Adversarial robustness training typically requires larger datasets than standard classification because models must be invariant to adversarial perturbations, which has higher sample demands in theory and practice.\"},{\"question\":\"How does the paper use unlabeled data to improve adversarial robustness?\",\"answer\":\"It proposes Unsupervised Adversarial Training (UAT), where unlabeled data is used to estimate the classifier’s smoothness around natural images and then combine this with limited labeled information to improve robustness.\"},{\"question\":\"What experimental gains does UAT achieve?\",\"answer\":\"On CIFAR-10, UAT improves robust accuracy by 21.7% compared with using only 4K supervised examples, and captures over 95% of the improvement attainable with the same amount of labeled data. It also reports further improvement on CIFAR-10 using additional unlabeled data from 80 Million Tiny Images.\"}]","Are Labels Required for Improving Adversarial Robustness? | PDF",25]