{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-robustness-against-multiple-l-p","title":"Adversarial Robustness against Multiple and Single $l_p$-Threat Models via Quick Fine-Tuning of Robust Classifiers","arxiv_id":"2105.12508","date":"2021-05-26","proceeding":null,"authors":["Francesco Croce","Matthias Hein"],"abstract":"A major drawback of adversarially robust models, in particular for large scale datasets like ImageNet, is the extremely long training time compared to standard ones. Moreover, models should be robust not only to one $l_p$-threat model but ideally to all of them. In this paper we propose Extreme norm Adversarial Training (E-AT) for multiple-norm robustness which is based on geometric properties of $l_p$-balls. E-AT costs up to three times less than other adversarial training methods for multiple-norm robustness. Using E-AT we show that for ImageNet a single epoch and for CIFAR-10 three epochs are sufficient to turn any $l_p$-robust model into a multiple-norm robust model. In this way we get the first multiple-norm robust model for ImageNet and boost the state-of-the-art for multiple-norm robustness to more than $51\\%$ on CIFAR-10. Finally, we study the general transfer via fine-tuning of adversarial robustness between different individual $l_p$-threat models and improve the previous SOTA $l_1$-robustness on both CIFAR-10 and ImageNet. Extensive experiments show that our scheme works across datasets and architectures including vision transformers.","url_abs":"https://arxiv.org/abs/2105.12508v2","url_pdf":"https://arxiv.org/pdf/2105.12508v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-robustness-against-multiple-l-p","repo_url":"https://github.com/fra31/robust-finetuning","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2105.12508","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2105.12508"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/fra31/robust-finetuning","reach":null}],"summary":{"ran_honours":1,"ran_draft_wrong":3,"ran_fixture":3},"by_repo_kind":{"official":{"samples":7,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"a1b32de808e46be1","entry":"L0_norm","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a1b32de808e46be1"}},{"code_sha256_prefix":"f0f026ce0c0e2f39","entry":"L1_projection","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f0f026ce0c0e2f39"}},{"code_sha256_prefix":"fa19820305aabe1d","entry":"L2_norm","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fa19820305aabe1d"}},{"code_sha256_prefix":"1c1759c14ebe4efe","entry":"apgd_train","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1c1759c14ebe4efe"}},{"code_sha256_prefix":"1b13d7d6e5549507","entry":"check_oscillation","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1b13d7d6e5549507"}},{"code_sha256_prefix":"278b4e6a4d60be18","entry":"dlr_loss","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"278b4e6a4d60be18"}},{"code_sha256_prefix":"d9464e6ee7eb0c8f","entry":"dlr_loss_targeted","repo":"fra31/robust-finetuning","repo_kind":"official","path":"autopgd_train.py","file_url":"https://github.com/fra31/robust-finetuning/blob/HEAD/autopgd_train.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d9464e6ee7eb0c8f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}