Papers › Robustifying ℓ_∞ Adversarial Training to the Union of Perturbation Models
Robustifying ℓ_∞ Adversarial Training to the Union of Perturbation Models
Ameya D. Patil, Michael Tuttle, Alexander G. Schwing, Naresh R. Shanbhag
Classical adversarial training (AT) frameworks are designed to achieve high adversarial accuracy against a single attack type, typically ℓ_∞ norm-bounded perturbations. Recent extensions in AT have focused on defending against the union of multiple perturbations but this benefit is obtained at the expense of a significant (up to 10×) increase in training complexity over single-attack ℓ_∞ AT. In this work, we expand the capabilities of widely popular single-attack ℓ_∞ AT frameworks to provide robustness to the union of (ℓ_∞, ℓ₂, ℓ₁) perturbations while preserving their training efficiency. Our technique, referred to as Shaped Noise Augmented Processing (SNAP), exploits a well-established byproduct of single-attack AT frameworks -- the reduction in the curvature of the decision boundary of networks. SNAP prepends a given deep net with a shaped noise augmentation layer whose distribution is learned along with network parameters using any standard single-attack AT. As a result, SNAP enhances adversarial accuracy of ResNet-18 on CIFAR-10 against the union of (ℓ_∞, ℓ₂, ℓ₁) perturbations by 14%-to-20% for four state-of-the-art (SOTA) single-attack ℓ_∞ AT frameworks, and, for the first time, establishes a benchmark for ResNet-50 and ResNet-101 on ImageNet.
In Syntology Open this paper in Syntology's Atlas, the map of the papers in Syntology's graph and their citations.
Code
Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.
Code Syntology ran Syntology
Not run by Syntology. Nothing on this page verifies that the listed code works.
Results from the paper archive 2025-07-28
No leaderboard rows for this paper in the archive.
Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections