CONSERVE-UPDATE-REVISE TO CURE GENERALIZATION AND ROBUSTNESS TRADE-OFF IN ADVERSARIAL TRAINING

Sep 18, 2026

Uploaded by Jacob

Adversarial training strengthens neural network robustness against adversarial attacks while creating a trade-off that can reduce performance on clean images. This study analyzes layer-wise learning during the shift from standard to adversarial training, showing that selectively updating certain layers while preserving others improves learning capacity. It introduces CURE, a dataset- and architecture-agnostic framework using a gradient prominence criterion for conservation, updating, and periodic revision, addressing memorization, overfitting, and robust overfitting.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages21

Reading Time53 min

AccessFree to download

Abstract

Introduction

Motivation and trade-off in adversarial generalization

Robust overfitting and the need for mechanistic understanding

CONSERVE-UPDATE-REVISE TO CURE GENERALIZATION AND ROBUSTNESS TRADE-OFF IN ADVERSARIAL TRAINING Shruthi Gowda 1,2 , Bahram Zonooz∗2,3 & Elahe Arani* 2,4 1NavInfo Europe 2Eindhoven University of Technology 3TomTom 4Wayve [s.gowda@tue.nl](s.gowda@tue.nl) , [b.zonooz@tue.nl](b.zonooz@tue.nl) , [e.arani@gmail.com](e.arani@gmail.com) ABSTRACT Adversarial training improves the robustness of neural networks against adversarial attacks, albeit at the expense of the trade-off between standard and robust generalization. To unveil the underlying factors driving this phenomenon, we examine the layer-wise learning capabilities of neural networks during the transition from a standard to an adversarial setting. Our empirical findings demonstrate that selectively updating specific layers while preserving others can substantially enhance the network’s learning capacity. We therefore propose CURE, a novel training framework that leverages a gradient prominence criterion to perform selective conservation, updating, and revision of weights. Importantly, CURE is designed to be dataset-and architecture-agnostic, ensuring its applicability across various scenarios. It effectively tackles both memorization and overfitting issues, thus enhancing the trade-off between robustness and generalization and additionally, this training approach also aids in mitigating ”robust overfitting”. Furthermore, our study provides valuable insights into the mechanisms of selective adversarial training and offers a promising avenue for future research. 1 1 INTRODUCTION The susceptibility of deep neural networks (DNNs) to adversarial attacks (Szegedy et al., 2014; Goodfellow et al., 2015) continues to present a substantial challenge in the field. Adversarial training has emerged as a promising strategy to enhance the robustness of DNNs against adversarial attacks (Madry et al., 2018; Zhang et al., 2019; Tramr et al., 2018; Wang et al., 2019) . However, transitioning from standard training with natural images to adversarial training introduces distinct behavior patterns. Despite the benefits of adversarial training in improving robustness, it often results in compromised performance on clean images, creating a noticeable trade-off between standard and adversarial generalization (Raghunathan et al., 2019) . Another intriguing observation is that, in contrast to the standard setting, longer durations of adversarial training can paradoxically lead to reduced test performance. This generalization gap in robustness between training and testing data, commonly referred to as robust overfitting (Rice et al., 2020), is prevalent in adversarial training. Therefore, it is imperative to gain a deeper understanding of the underlying factors driving these behaviors to advance the development of reliable and trustworthy AI systems. Few studies have attempted to understand learning behavior in an adversarial setting. Nakkiran (2019) show that the capacity of the network needs to be increased for better generalization, while others have found that this is not always the case (Huang et al., 2021) . Additionally, suggestions include the need for larger amounts of data, labeled (Schmidt et al., 2018) or unlabeled (Carmon et al., 2019; Najafi et al., 2019), for better performance. Other works have revealed that the discord between natural and adversarial accuracy is caused by differently trained feature representations (Tsipraset al., 2018; Ilyas et al., 2019) . However, numerous aspects of neural network learning behavior when confronted with adversarial samples remain unexplored. Exploring how networks adapt to both natural and adversarial data can yield valuable insights into their learning dynamics and capabilities. ∗ Contributed equally. 1The code is available at: [https://github.com/NeurAI-Lab/CURE](https://github.com/NeurAI-Lab/CURE). Our study empirically investigates neural network learning capabilities during the transition from standard to adversarial settings.

FAQs

What trade-off does adversarial training create?

Adversarial training improves robustness against attacks, but often compromises performance on clean images, producing a trade-off between standard and robust generalization.

What does the layer-wise analysis show in this paper?

It shows that not all network weights must change; selectively updating specific layers while preserving others can significantly enhance learning capacity during the standard-to-adversarial transition.

How does CURE work to improve robustness and generalization?

CURE uses a gradient prominence criterion to decide which parameters to conserve, update, and revise periodically, aiming to balance retention of natural knowledge with learning adversarial knowledge and reducing robust overfitting.

Sep 18, 2026

Uploaded by Jacob