AT-AER: Adversarial Training With Adaptive Example Reuse

Abstract

Adversarial training (AT) is widely regarded as a crucial defense method for deep neural networks against adversarial attacks. Most of the existing AT methods suffer from the problems of insufficient coverage of perturbation space and robust overfitting. In view of this, we propose an AT framework with adaptive example reuse (AT-AER) to help improve the adversarial robustness of deep models. In AT-AER, a new concept named 2nd-order adversarial example (AE) is proposed by adaptively filtering AEs generated during the historical training phase, which achieves sufficient coverage of diverse attack directions. Meanwhile, by analysing the fundamental causes of robust overfitting, we propose the strategies of wave descending learning rate (WDLR), cosine increasing weight decay (CIWD) and cosine increasing attack strength (CIAS) in collaboration with AT-AER to optimise models. In addition, the Stochastic Weight Averaging (SWA) technique is introduced to further improve the stability of training. Finally, experiments on three benchmark datasets show that AT-AER exhibits significant advantages in the face of strong adversarial attacks. Its adaptive mechanism effectively alleviates the phenomenon of robust overfitting where the performance difference between the best model and the last model is less than 1%. The study further reveals that using traditional weak attacks (e.g., FGSM) to evaluate the robustness of models may lead to a false sense of reliability, indicating the necessity of using strong attacks for robustness evaluation. This study provides a solution for AT that balances efficiency and performance.

Keywords

adversarial training / example reuse / 2nd-order adversarial example / adversarial robustness

Acknowledgements

This work was supported in part by the National Natural Science Foundation of China (62576214, 62376161 and 62176160); in part by the Guangdong Basic and Applied Basic Research Foundation (2024B1515020109); in part by the Guangdong Key Laboratory of Intelligent Information Processing (2023B1212060076); and in part by the 2025 Characteristics and Innovation Grant for college of Guangdong Province (2025KTSCX152).

Funding

The authors have nothing to report.

Conflicts of Interest

The authors declare no conflicts of interest.

Data Availability Statement

The data that support the findings of this study are available from the corresponding author upon reasonable request.

References

[1] J. Wang, S. Wang, and Y. Zhang, “Deep Learning on Medical Image Analysis,” CAAI Transactions on Intelligence Technology 10, no. 1 (2025): 1-35, https://doi.org/10.1049/cit2.12356.

[2] Y. He, L. Jin, H. Wang, X. Sun, Z. Huo, and G. Wang, “An Object Detection Algorithm Based on Deep Learning and Salient Feature Fusion for Roadside Surveillance Camera,” CAAI Transactions on Intelligence Technology (2025): 1-18, https://doi.org/10.1049/cit2.12406.

[3] Y. Wang, Q. Liu, T. Dai, J. Lang, L. Lu, and Y. Chen, “Contrastive Learning for Nested Chinese Named Entity Recognition via Template Words,” CAAI Transactions on Intelligence Technology 10, no. 2 (2025): 450-459, https://doi.org/10.1049/cit2.12403.

[4] C. Szegedy, W. Zaremba, I. Sutskever, et al., Intriguing Properties of Neural Network,” in Proceedings of the 2nd International Conference on Learning Representations (ICLR) (ICLR, 2014).

[5] A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, and D. Mukhopadhyay, “A Survey on Adversarial Attacks and Defences,” CAAI Transactions on Intelligence Technology 6, no. 1 (2021): 25-45, https://doi.org/10.1049/cit2.12028.

[6] I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” in Proceedings of the 3rd International Conference on Learning Representations (ICLR) (ICLR, 2015).

[7] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” in Proceedings of the 6th International Conference on Learning Representations (ICLR), Vol. 6 (ICLR, 2018).

[8] A. Kurakina, I. Goodfellow, and S. Bengio, “Adversarial Examples in the Physical World,” in Proceedings of the 5th International Conference on Learning Representations (ICLR) (ICLR, 2017).

[9] Y. Dong, F. Liao, T. Pang, et al., Boosting Adversarial Attacks With Momentum,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (IEEE, 2018), 9185-9193, https://doi.org/10.1109/cvpr.2018.00957.

[10] H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaou, and M. I. Jordan, “Theoretically Principled Trade-Off Between Robustness and Accuracy,” in Proceedings of the 36th International Conference on Machine Learning (ICML), Vol. 97 (2019), 7472-7482.

[11] Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving Adversarial Robustness Requires Revisiting Misclassified Examples,” in Proceedings of the 8th International Conference on Learning Representations (ICLR), Vol. 12 (ICLR, 2020).

[12] E. Chen and C. Lee, “Data Filtering for Efficient Adversarial Training,” Pattern Recognition 151 (2024): 110394, https://doi.org/10.1016/j.patcog.2024.110394.

[13] R. Wang, H. Ke, M. Hu, and W. Wu, “Adversarially Robust Neural Networks With Feature Uncertainty Learning and Label Embedding,” Neural Networks 172 (2024): 106087, https://doi.org/10.1016/j.neunet.2023.12.041.

[14] H. Lee, S. Lee, H. Bae, and S. Yoon, “Regularizing Hard Examples Improves Adversarial Robustness,” Journal of Machine Learning Research 26, no. 20 (2025): 1-48, http://jmlr.org/papers/v26/22-1428.html.

[15] Y. Bai, M. Zhou, V. Patel, and S. Sojoudi, “Mixednuts: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifiers,” Transactions on Machine Learning Research (2024): 1-27. https://doi.org/10.48550/arXiv.2402.02263.

[16] Y. Bai, B. G. Anderson, A. Kim, and S. Sojoudi, “Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothing,” SIAM Journal on Mathematics of Data Science 6, no. 3 (2024): 788-814, https://doi.org/10.1137/23m1564560.

[17] H. Wang and Y. Wang, “Self-Ensemble Adversarial Training for Improved Robustness,” in Proceedings of the 10th International Conference on Learning Representations (ICLR) (2022), 5652-5669.

[18] R. Guo, Q. Chen, H. Liu, and W. Wang, “Adversarial Robustness Enhancement for Deep Learning-Based Soft Sensors: An Adversarial Training Strategy Using Historical Gradients and Domain Adaptation,” Senors 24, no. 3909 (2024): 1-15, https://doi.org/10.3390/s24123909.

[19] X. Jia, Y. Zhang, X. Wei, et al., Improving Fast Adversarial Training With Prior-Guided Knowledge,” IEEE Transactions on Pattern Analysis and Machine Intelligence 46, no. 9 (2024): 6367-6383, https://doi.org/10.1109/tpami.2024.3381180.

[20] Z. Li, D. Yu, L. Wei, C. Jin, Y. Zhang, and S. Chan, “Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (IEEE, 2018), 24776-24785, https://doi.org/10.1109/cvpr52733.2024.02340.

[21] L. Zhao, W. W. Ng, J. Zhang, and H. Zhou, “Mitigating Robust Overfitting and Semantic Distortion via Dual-Decoupled Adversarial Robustness Distillation,” (2025), https://ssrn.com/abstract=5475990.

[22] J. Zhang, P. Xiao, R. Sun, and Z. Luo, “A Single-Loop Smoothed Gradient Descent-Ascent Algorithm for Nonconvex-Concave Min-Max Problems,” in Proceedings of the 34th Conference on Neural Information Processing Systems (NIPS) Vol. 3 (2020): 7377-7389, https://dl.acm.org/doi/10.5555/3495724.3496343.

[23] S. Addepalli, G. S. S. Jain, and R. V. Babu, “Scaling Adversarial Training to Large Perturbation Bounds,” in Proceedings of the 18th European Conference on Computer Vision (ECCV), Vol. 13665 (2022), 301-316.

[24] X. Jia, Y. Zhang, B. Wu, K. Ma, J. Wang, and X. Cao, “Las-at: Adversarial Training With Learnable Attack Strategy,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (IEEE, 2022), 13388-13398, https://doi.org/10.1109/cvpr52688.2022.01304.

[25] S. He, J. Wei, C. Zhang, et al., Boosting Adversarial Training With Hardness-Guided Attack Strategy,” IEEE Transactions on Multimedia 26 (2024): 7748-7760, https://doi.org/10.1109/tmm.2024.3371211.

[26] Z. Wang, H. Wang, C. Tian, and Y. Jin, “Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-Level Optimization Perspective,” in Proceedings of the 20th European Conference on Computer Vision, Vol. 15086 (2025), 144-160.

[27] P. Izmailov, D. Podoprikhin, T. Garipov, D. Vetrov, and A. G. Wilson, “Averaging Weights Leads to Wider Optima and Better Generalization,” in Proceedings of the 34th Conference on Uncertainty in Artificial Intelligence (UAI) (2018), 876-885.

[28] A. Krizhevsky, “Learning Multiple Layers of Features From Tiny Images,” (Master’s thesis, University of Toronto, 2009).

[29] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng, “Reading Digits in Natural Images With Unsupervised Feature Learning,” in Proceedings of the NIPS Workshop on Deep Learning and Unsupervised Feature Learning (NIPS workshop, 2011).

[30] D. Wu, S. Xia, and Y. Wang, “Adversarial Weight Perturbation Helps Robust Generalization,” in Proceedings of the 34th Conference on Neural Information Processing Systems (NIPS), Vol. 33 (2020), 2958-2969.

[31] C. Yu, B. Han, L. Shen, et al., Understanding Robust Overfitting of Adversarial Training and Beyond,” in Proceedings of the 39th International Conference on Machine Learning (ICML), Vol. 162 (2022), 25595-25610.

[32] J. Cui, Z. Tian, Z. Zhong, X. Qi, B. Yu, and H. Zhang, “Decoupled Kullback-Leibler Divergence Loss,” in Proceedings of the 38th Conference on Neural Information Processing Systems (NIPS), Vol. 37 (2024), 74461-74486.

[33] Y. Liu, Y. Cheng, L. Gao, X. Liu, Q. Zhang, and J. Song, “Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (IEEE, 2022), 15105-15114, https://doi.org/10.1109/cvpr52688.2022.01468.

[34] J. Su, D. Vargas, and S. Kouichi, “One Pixel Attack for Fooling Deep Neural Networks,” IEEE Transactions on Evolutionary Computation 23, no. 3 (2019): 828-841, https://doi.org/10.1109/tevc.2019.2890858.

[35] M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square Attack: A Query-Efficient Black-Box Adversarial Attack via Random Search,” in Proceedings of the 16th European Conference on Computer Vision (ECCV), Vol. 12368 (2020), 484-501.

[36] F. Groce and M. Hein, “Reliable Evaluation of Adversarial Robustness With an Ensemble of Diverse Parameter-Free Attacks,” in Proceedings of the 37th International Conference on Machine Learning (ICML), Vol. 119 (2020), 2206-2216.

[37] F. Groce and M. Hein, “Minimally Distorted Adversarial Examples With a Fast Adaptive Boundary Attack,” in Proceedings of the 37th International Conference on Machine Learning (ICML), Vol. 119 (2020), 2196-2205.

[38] K. He, X. Zhang, S. Ren, and J. Sun, “Deep Residual Learning for Image Recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (IEEE, 2016), 770-778, https://doi.org/10.1109/cvpr.2016.90.

[39] S. Zagoruyko and N. Komodakis, “Wide Residual Networks,” in Proceedings of the British Machine Vision Conference (BMVC) (BMVC, 2016).

[40] E. Wong, L. Rice, and J. Kolter, “Fast Is Better Than Free: Revisiting Adversarial Training,” in Proceedings of the 8th International Conference on Learning Representations (ICLR), Vol. 8 (ICLR, 2020).

[41] X. Jia, Y. Zhang, X. Wei, et al., Prior-Guided Adversarial Initialization for Fast Adversarial Training,” in Proceedings of the 17th European Conference on Computer Vision (ECCV), Vol. 13664 (2022), 567-584.