[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-501784-105":59,"doc-detail-501784-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","confidence-calibrated-adversarial-training-generalizing-to-unseen-attacks","Confidence-Calibrated Adversarial Training - Generalizing to Unseen Attacks","","Adversarial training can produce robust models under a specific threat model, yet robustness often fails to transfer to genuinely new threat models such as different Lp norms or larger perturbations. Confidence-Calibrated Adversarial Training (CCAT) addresses this by biasing the model toward low-confidence predictions on adversarial examples. With confidence-thresholding to reject low-confidence inputs, CCAT trained only on L1 adversarial examples generalizes to unseen attacks and improves worst-case robust test error while preserving better clean accuracy. It is evaluated using novel white- and black-box attacks that directly maximize confidence.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/confidence-calibrated-adversarial-training-generalizing-to-unseen-attacks/501784/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/confidence-calibrated-adversarial-training-generalizing-to-unseen-attacks/501784.png","ImageObject",300,407,{"name":92,"@type":93},"Aditya","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-22","2026-10-03",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",13,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What problem does CCAT aim to solve compared with standard adversarial training?","Question",{"text":113,"@type":114},"CCAT targets the lack of generalization from the threat model used during training to previously unseen threat models, such as different Lp norms or larger perturbations.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How does CCAT change model behavior on adversarial examples?",{"text":118,"@type":114},"CCAT biases predictions toward low-confidence outputs on adversarial examples and enforces a confidence decay that extrapolates beyond the training threat model region.",{"name":120,"@type":111,"acceptedAnswer":121},"How is CCAT evaluated and what robustness metric is reported?",{"text":122,"@type":114},"The paper evaluates robustness with novel white- and black-box attacks that maximize confidence, using multiple attacks with random restarts and iterations, and reports worst-case robust test error under the confidence-thresholded setting.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},501784,1791029253,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":145,"read_time":41},962085564549,"https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks  \nDavid Stutz 1 Matthias Hein 2 Bernt Schiele 1  \nAbstract  \nAdversarial training yields robust models against a specific threat model, e.g., L1 adversarial examples. Typically robustness does not generalize to previously unseen threat models, e.g., other Lp norms, or larger perturbations. Our confidencecalibrated adversarial training (CCAT) tackles this problem by biasing the model towards low confidence predictions on adversarial examples.  \nBy allowing to reject examples with low confidence, robustness generalizes beyond the threat model employed during training. CCAT, trained only on L1 adversarial examples, increases robustness against larger L1 , L2 , L 1 and L0 attacks, adversarial frames, distal adversarial examples and corrupted examples and yields better clean accuracy compared to adversarial training. For thorough evaluation we developed novel white-and black-box attacks directly attacking CCAT by maximizing confidence. For each threat model, we use 7 attacks with up to 50 restartsand 5000 iterations and report worst-case robust test error, extended to our confidence-thresholded setting, across all attacks.  \n1. Introduction  \nDeep networks were shown to be susceptible to adversarial examples (Szegedy et al., 2014): adversarially perturbed examples that cause mis-classification while being nearly“imperceptible”, i.e., close to the original example. Here,“closeness” is commonly enforced by constraining the Lp norm of the perturbation, referred to as threat model. Since then, numerous defenses against adversarial examples have been proposed. However, many were unable to keep up with more advanced attacks (Athalye et al., 2018 ; Athalye & Carlini, 2018) . Moreover, most defenses are tailored to only one specific threat model.  \n1Max Planck Institute for Informatics, Saarland Informatics Campus, Saarbr¨ucken 2University of T¨ubingen, T¨ubingen. Correspondence to: David Stutz \u003C[david.stutz@mpi-inf.mpg.de](david.stutz@mpi-inf.mpg.de) >.  \nProceedings of the 37th International Conference on Machine Learning, Online, PMLR 119, 2020 . Copyright 2020 by the author(s) .  \nFigure 1: Adversarial Training (AT) versus our CCAT.  \nWe plot the confidence in the direction of an adversarial example. AT enforces high confidence predictions for the correct class on the L1-ball of radius 􀀏 (“seen” attack during training, top left) . As AT enforces no particular bias beyond the 􀀏-ball, adversarial examples can be found right beyond this ball. In contrast CCAT enforces a decaying confidence in the correct class up to uniform confidence within the 􀀏-ball (top right) . Thus, CCAT biases the model to extrapolate uniform confidence beyond the 􀀏-ball. This behavior also extends to “unseen” attacks during training, e.g., L2 attacks (bottom), such that adversarial examples can be rejected via confidence-thresholding.  \nAdversarial training (Goodfellow et al., 2015 ; Madry et al., 2018), i.e., training on adversarial examples, can be regarded as state-of-the-art. However, following Fig. 1, adversarial training is known to “overfit” to the threat model “seen”during training, e.g., L1 adversarial examples. Thus, robustness does not extrapolate to larger L1 perturbations, cf. Fig. 1 (top left), or generalize to “unseen” attacks, cf. Fig. 1 (bottom left), e.g., other Lp threat models (Sharma & Chen, 2018 ; Tramr & Boneh, 2019 ; Li et al., 2019 ; Kang et al., 2019 ; Maini et al., 2020) . We hypothesize this tobe a result of enforcing high-confidence predictions on adversarial examples. However, high-confidence predictions are difficult to extrapolate beyond the adversarial examples seen during training. Moreover, it is not meaningful to extrapolate high-confidence predictions to arbitrary regions.  \nFinally, adversarial training often hurts accuracy, resulting in a robustness-accuracy trade-off (Tsipras et al., 2019 ; Stutz et al., 2019 ; Raghunathan et al., 2019 ; Zhang et al., 2019) .  \nContribut","cbCaijz7MVZmQqzk","https://ap.wps.com/l/cbCaijz7MVZmQqzk","pdf",1011722,12,"English","# Abstract\n# Introduction\n## Adversarial examples and threat models\n## Limitations of standard adversarial training\n## Contributions of CCAT\n## Evaluation methodology","[{\"question\":\"What problem does CCAT aim to solve compared with standard adversarial training?\",\"answer\":\"CCAT targets the lack of generalization from the threat model used during training to previously unseen threat models, such as different Lp norms or larger perturbations.\"},{\"question\":\"How does CCAT change model behavior on adversarial examples?\",\"answer\":\"CCAT biases predictions toward low-confidence outputs on adversarial examples and enforces a confidence decay that extrapolates beyond the training threat model region.\"},{\"question\":\"How is CCAT evaluated and what robustness metric is reported?\",\"answer\":\"The paper evaluates robustness with novel white- and black-box attacks that maximize confidence, using multiple attacks with random restarts and iterations, and reports worst-case robust test error under the confidence-thresholded setting.\"}]","Confidence-Calibrated Adversarial Training - Generalizing to Unseen Attacks | PDF",1791024661]