[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-272060-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-272060-en":131},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","eliminating-catastrophic-overfitting-via-abnormal-adversarial-examples-regularization-paper","Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularization - Paper","","Single-step adversarial training (SSAT) improves efficiency and robustness but can suffer catastrophic overfitting (CO), where the classifier becomes severely distorted and rapidly loses robustness against multi-step adversarial attacks. The work identifies abnormal adversarial examples (AAEs), whose associated loss decreases despite being produced by the inner maximization process. AAEs strongly correlate with classifier distortion and vary sharply at CO onset. AAER mitigates CO by regularizing AAE generation, eliminating CO with negligible computational overhead while improving adversarial robustness.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/eliminating-catastrophic-overfitting-via-abnormal-adversarial-examples-regularization-paper/272060/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/eliminating-catastrophic-overfitting-via-abnormal-adversarial-examples-regularization-paper/272060.png","ImageObject",300,407,{"name":42,"@type":43},"Cipher","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-30","2026-09-15",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",15,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What is catastrophic overfitting (CO) in single-step adversarial training (SSAT)?","Question",{"text":63,"@type":64},"CO is a sharp decline in robust accuracy under multi-step adversarial attacks, occurring within a few iterations and indicating severe classifier distortion.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What are abnormal adversarial examples (AAEs)?",{"text":68,"@type":64},"AAEs are adversarial examples produced during SSAT’s inner maximization process whose associated loss decreases instead of increasing normally.",{"name":70,"@type":61,"acceptedAnswer":71},"How does AAER prevent CO?",{"text":72,"@type":64},"AAER introduces a regularization term that suppresses the generation of AAEs, breaking the vicious circle between classifier distortion and AAE variation, thereby eliminating CO with negligible extra overhead.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},272060,1789462970,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,127],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":25,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":25,"category_name":129,"show_sort_weight":97,"slug":130},19,"General","general",{"code":4,"msg":82,"data":132},{"doc_id":79,"user_id":133,"nickname":42,"user_avatar":134,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":118,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":80,"read_time":104,"preview_page_count":4},687208528416,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularization  \nRunqi Lin Chaojian Yu Tongliang Liu∗  \nSydney AI Centre, The University of Sydney  \n{rlin0511, chyu8051, [tongliang.liu}@sydney.edu.au](tongliang.liu}@sydney.edu.au)  \nAbstract  \nSingle-step adversarial training (SSAT) has demonstrated the potential to achieve both efficiency and robustness. However, SSAT suffers from catastrophic overfitting (CO), a phenomenon that leads to a severely distorted classifier, making it vulnerable to multi-step adversarial attacks. In this work, we observe that some adversarial examples generated on the SSAT-trained network exhibit anomalous behaviour, that is, although these training samples are generated by the inner maximization process, their associated loss decreases instead, which we named abnormal adversarial examples (AAEs) . Upon further analysis, we discover a close relationship between AAEs and classifier distortion, as both the number and outputs of AAEs undergo a significant variation with the onset of CO. Given this observation, we re-examine the SSAT process and uncover that before the occurrence of CO, the classifier already displayed a slight distortion, indicated by the presence of few AAEs. Furthermore, the classifier directly optimizing these AAEs will accelerate its distortion, and correspondingly, the variation of AAEs will sharply increase as a result. In such a vicious circle, the classifier rapidly becomes highly distorted and manifests as CO within a few iterations. These observations motivate us to eliminate CO by hindering the generation of AAEs. Specifically, we design a novel method, termed Abnormal Adversarial Examples Regularization (AAER), which explicitly regularizes the variation of AAEs to hinder the classifier from becoming distorted. Extensive experiments demonstrate that our method can effectively eliminate CO and further boost adversarial robustness with negligible additional computational overhead. Our implementation can be found at [https://github.com/tmllab/2023_NeurIPS_AAER](https://github.com/tmllab/2023_NeurIPS_AAER).  \n1 Introduction  \nIn recent years, deep neural networks (DNNs) have demonstrated impressive performance in various decision-critical domains, such as autonomous driving [25, 12], face recognition [31, 3] and medical imaging diagnosis [8] . However, DNNs were found to be vulnerable to adversarial examples [35, 9, 16] . Although these adversarial perturbations are imperceptible to human eyes, they can lead toa completely different prediction in DNNs. To this end, many adversarial defence strategies have been proposed, such as pre-processing techniques [13], detection algorithms [27], verification and provable defence [20, 44], and adversarial training (AT) [11, 26, 46] . Among them, AT is considered to be the most effective method against adversarial attacks [2, 4] .  \nDespite the notable progress in improving model robustness, the standard multi-step AT significantly increases the computational overhead due to the iterative steps of forward and backward propagation [26, 40, 41, 42, 48, 47] . In light of this, several works have attempted to use single-step adversarial training (SSAT) as a more efficient alternative to achieve robustness. Unfortunately, a  \n∗ Corresponding author  \n37th Conference on Neural Information Processing Systems (NeurIPS 2023) .  \nserious problem catastrophic overfitting (CO) has been identified in SSAT [39], manifesting as a sharp decline in the model’s robust accuracy against multistep adversarial attacks, plummeting from a peak to nearly 0% within a few iterations, as shown in Figure 1. This intriguing phenomenon has been widely investigated and prompted numerous efforts to resolve it. Recently, Kim [21] pointed out that the SSAT-trained classifiers are typically accompanied by highly distorted decision boundaries, which will lead to the model manifestation as CO. However, the underlying process of the classifier’s gradual ","cbCaieR2Zxsc3vwS","https://ap.wps.com/l/cbCaieR2Zxsc3vwS","pdf",12150803,"English","# Abstract\n# Introduction\n## Background on adversarial examples and defenses\n## Problem of catastrophic overfitting in SSAT\n## Abnormal adversarial examples and their correlation\n## Proposed solution: Abnormal Adversarial Examples Regularization (AAER)","[{\"question\":\"What is catastrophic overfitting (CO) in single-step adversarial training (SSAT)?\",\"answer\":\"CO is a sharp decline in robust accuracy under multi-step adversarial attacks, occurring within a few iterations and indicating severe classifier distortion.\"},{\"question\":\"What are abnormal adversarial examples (AAEs)?\",\"answer\":\"AAEs are adversarial examples produced during SSAT’s inner maximization process whose associated loss decreases instead of increasing normally.\"},{\"question\":\"How does AAER prevent CO?\",\"answer\":\"AAER introduces a regularization term that suppresses the generation of AAEs, breaking the vicious circle between classifier distortion and AAE variation, thereby eliminating CO with negligible extra overhead.\"}]","Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularization - Paper | PDF"]