{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-training-for-free","title":"Adversarial Training for Free!","arxiv_id":"1904.12843","date":"2019-04-29","proceeding":"NeurIPS 2019 12","authors":["Ali Shafahi","Mahyar Najibi","Amin Ghiasi","Zheng Xu","John Dickerson","Christoph Studer","Larry S. Davis","Gavin Taylor","Tom Goldstein"],"abstract":"Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters. Our \"free\" adversarial training algorithm achieves comparable robustness to PGD adversarial training on the CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks. The code is available at https://github.com/ashafahi/free_adv_train.","url_abs":"https://arxiv.org/abs/1904.12843v2","url_pdf":"https://arxiv.org/pdf/1904.12843v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-training-for-free","repo_url":"https://github.com/ashafahi/free_adv_train","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"adversarial-training-for-free","repo_url":"https://github.com/mahyarnajibi/FreeAdversarialTraining","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"adversarial-training-for-free","repo_url":"https://github.com/a1600012888/YOPO-You-Only-Propagate-Once","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"adversarial-training-for-free","repo_url":"https://github.com/locuslab/fast_adversarial","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"adversarial-training-for-free","repo_url":"https://github.com/simon0987/Fast_FGSM","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"adversarial-training-for-free","repo_url":"https://github.com/AlanChou/Adversarial-Training-for-Free","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"domain-generalization","task_name":"Domain Generalization"},{"task_slug":"classification","task_name":"General Classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/adversarial-defense-on-imagenet-non-targeted","task":"Adversarial Defense","dataset":"ImageNet (non-targeted PGD, max perturbation=4)","model":"ResNet-152 free-m=4","rank_in_archive_order":3,"of":5,"metrics":{"Accuracy":"36.0%"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-defense-on-imagenet-non-targeted","task":"Adversarial Defense","dataset":"ImageNet (non-targeted PGD, max perturbation=4)","model":"ResNet-101 free-m=4","rank_in_archive_order":4,"of":5,"metrics":{"Accuracy":"34.3%"},"uses_additional_data":false},{"leaderboard":"/sota/adversarial-defense-on-imagenet-non-targeted","task":"Adversarial Defense","dataset":"ImageNet (non-targeted PGD, max perturbation=4)","model":"ResNet-50 free-m=4","rank_in_archive_order":5,"of":5,"metrics":{"Accuracy":"31.8%"},"uses_additional_data":false},{"leaderboard":"/sota/domain-generalization-on-vizwiz","task":"Domain Generalization","dataset":"VizWiz-Classification","model":"ResNet-50 (adv-train-free)","rank_in_archive_order":85,"of":90,"metrics":{"Accuracy - All Images":"26.7","Accuracy - Clean Images":"30.9","Accuracy - Corrupted Images":"20.5"},"uses_additional_data":false}],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1904.12843","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1904.12843"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/AlanChou/Adversarial-Training-for-Free","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/mahyarnajibi/FreeAdversarialTraining","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/a1600012888/YOPO-You-Only-Propagate-Once","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ashafahi/free_adv_train","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/simon0987/Fast_FGSM","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/locuslab/fast_adversarial","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":1},"by_repo_kind":{"official":{"samples":1,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":1,"samples":[{"code_sha256_prefix":"7125f3a9f5bb8e47","entry":"get_path_dir","repo":"ashafahi/free_adv_train","repo_kind":"official","path":"free_train.py","file_url":"https://github.com/ashafahi/free_adv_train/blob/HEAD/free_train.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7125f3a9f5bb8e47"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}