[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-297180-105":59,"doc-detail-297180-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","conserve-update-revise-to-cure-generalization-and-robustness-trade-off-in-adversarial-training","CONSERVE-UPDATE-REVISE TO CURE GENERALIZATION AND ROBUSTNESS TRADE-OFF IN ADVERSARIAL TRAINING","","Adversarial training strengthens neural network robustness against adversarial attacks while creating a trade-off that can reduce performance on clean images. This study analyzes layer-wise learning during the shift from standard to adversarial training, showing that selectively updating certain layers while preserving others improves learning capacity. It introduces CURE, a dataset- and architecture-agnostic framework using a gradient prominence criterion for conservation, updating, and periodic revision, addressing memorization, overfitting, and robust overfitting.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/conserve-update-revise-to-cure-generalization-and-robustness-trade-off-in-adversarial-training/297180/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/conserve-update-revise-to-cure-generalization-and-robustness-trade-off-in-adversarial-training/297180.png","ImageObject",300,407,{"name":92,"@type":93},"Jacob","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-29","2026-09-18",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",12,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What trade-off does adversarial training create?","Question",{"text":113,"@type":114},"Adversarial training improves robustness against attacks, but often compromises performance on clean images, producing a trade-off between standard and robust generalization.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"What does the layer-wise analysis show in this paper?",{"text":118,"@type":114},"It shows that not all network weights must change; selectively updating specific layers while preserving others can significantly enhance learning capacity during the standard-to-adversarial transition.",{"name":120,"@type":111,"acceptedAnswer":121},"How does CURE work to improve robustness and generalization?",{"text":122,"@type":114},"CURE uses a gradient prominence criterion to decide which parameters to conserve, update, and revise periodically, aiming to balance retention of natural knowledge with learning adversarial knowledge and reducing robust overfitting.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},297180,1790157726,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":145,"read_time":146,"preview_page_count":4},962084931830,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","CONSERVE-UPDATE-REVISE TO CURE GENERALIZATION AND ROBUSTNESS TRADE-OFF IN ADVERSARIAL TRAINING  \nShruthi Gowda 1,2 , Bahram Zonooz∗2,3 & Elahe Arani* 2,4  \n1NavInfo Europe 2Eindhoven University of Technology 3TomTom 4Wayve  \n[s.gowda@tue.nl](s.gowda@tue.nl) , [b.zonooz@tue.nl](b.zonooz@tue.nl) , [e.arani@gmail.com](e.arani@gmail.com)  \nABSTRACT  \nAdversarial training improves the robustness of neural networks against adversarial attacks, albeit at the expense of the trade-off between standard and robust generalization. To unveil the underlying factors driving this phenomenon, we examine the layer-wise learning capabilities of neural networks during the transition from a standard to an adversarial setting. Our empirical findings demonstrate that selectively updating specific layers while preserving others can substantially enhance the network’s learning capacity. We therefore propose CURE, a novel training framework that leverages a gradient prominence criterion to perform selective conservation, updating, and revision of weights. Importantly, CURE is designed to be dataset-and architecture-agnostic, ensuring its applicability across various scenarios. It effectively tackles both memorization and overfitting issues, thus enhancing the trade-off between robustness and generalization and additionally, this training approach also aids in mitigating ”robust overfitting”. Furthermore, our study provides valuable insights into the mechanisms of selective adversarial training and offers a promising avenue for future research. 1  \n1 INTRODUCTION  \nThe susceptibility of deep neural networks (DNNs) to adversarial attacks (Szegedy et al., 2014; Goodfellow et al., 2015) continues to present a substantial challenge in the field. Adversarial training has emerged as a promising strategy to enhance the robustness of DNNs against adversarial attacks (Madry et al., 2018; Zhang et al., 2019; Tramr et al., 2018; Wang et al., 2019) . However, transitioning from standard training with natural images to adversarial training introduces distinct behavior patterns. Despite the benefits of adversarial training in improving robustness, it often results in compromised performance on clean images, creating a noticeable trade-off between standard and adversarial generalization (Raghunathan et al., 2019) . Another intriguing observation is that, in contrast to the standard setting, longer durations of adversarial training can paradoxically lead to reduced test performance. This generalization gap in robustness between training and testing data, commonly referred to as robust overfitting (Rice et al., 2020), is prevalent in adversarial training. Therefore, it is imperative to gain a deeper understanding of the underlying factors driving these behaviors to advance the development of reliable and trustworthy AI systems.  \nFew studies have attempted to understand learning behavior in an adversarial setting. Nakkiran (2019) show that the capacity of the network needs to be increased for better generalization, while others have found that this is not always the case (Huang et al., 2021) . Additionally, suggestions include the need for larger amounts of data, labeled (Schmidt et al., 2018) or unlabeled (Carmon et al., 2019; Najafi et al., 2019), for better performance. Other works have revealed that the discord between natural and adversarial accuracy is caused by differently trained feature representations (Tsipraset al., 2018; Ilyas et al., 2019) . However, numerous aspects of neural network learning behavior when confronted with adversarial samples remain unexplored. Exploring how networks adapt to both natural and adversarial data can yield valuable insights into their learning dynamics and capabilities.  \n∗ Contributed equally.  \n1The code is available at: [https://github.com/NeurAI-Lab/CURE](https://github.com/NeurAI-Lab/CURE).  \nOur study empirically investigates neural network learning capabilities during the transition from standard to adversarial settings.","cbCaibI51pNHGGOR","https://ap.wps.com/l/cbCaibI51pNHGGOR","pdf",2312333,21,"English","# Abstract\n# Introduction\n## Motivation and trade-off in adversarial generalization\n## Robust overfitting and the need for mechanistic understanding","[{\"question\":\"What trade-off does adversarial training create?\",\"answer\":\"Adversarial training improves robustness against attacks, but often compromises performance on clean images, producing a trade-off between standard and robust generalization.\"},{\"question\":\"What does the layer-wise analysis show in this paper?\",\"answer\":\"It shows that not all network weights must change; selectively updating specific layers while preserving others can significantly enhance learning capacity during the standard-to-adversarial transition.\"},{\"question\":\"How does CURE work to improve robustness and generalization?\",\"answer\":\"CURE uses a gradient prominence criterion to decide which parameters to conserve, update, and revise periodically, aiming to balance retention of natural knowledge with learning adversarial knowledge and reducing robust overfitting.\"}]","CONSERVE-UPDATE-REVISE TO CURE GENERALIZATION AND ROBUSTNESS TRADE-OFF IN ADVERSARIAL TRAINING | PDF",1789742099,53]