缓解快速对抗训练中的误差放大
Mitigating Error Amplification in Fast Adversarial Training
针对快速对抗训练中的灾难性过拟合，按样本置信度动态缩放扰动预算并调节监督信号，可直接嵌入现有 FAT 流程（如 FGSM-RS）以在几乎不增加成本的前提下提升鲁棒性并缓解干净精度下降。
原文依据 we propose a Distribution-aware Dynamic Guidance (DDG) strategy that dynamically adjusts both the perturbation budget and supervision signal
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论快速对抗训练（FAT）通过促使网络学习对扰动不变的表示，已被证明能有效增强模型鲁棒性。然而，FAT 常常遭遇灾难性过拟合（CO），即模型对训练时使用的攻击过拟合，而无法泛化到未见过的攻击。此外，面向鲁棒性的优化通常会导致干净输入上的性能显著下降，且随着扰动预算增大，这种下降愈发严重。在本工作中，我们通过在不同置信度分组上调节扰动与监督水平，全面分析了引导强度如何影响模型性能。研究发现，低置信度样本是灾难性过拟合与鲁棒性-准确率权衡的主要来源。基于这一洞见，我们提出分布感知动态引导（DDG）策略，动态调整扰动预算与监督信号。具体而言，DDG 根据样本在真实类别上的置信度缩放扰动幅度，从而引导样本趋向一致的决策边界，同时减轻学习虚假相关的影响。与此同时，它根据每个样本的预测状态动态调整监督信号，避免过度强调错误信号。为缓解动态引导可能带来的梯度不稳定，我们进一步设计了加权正则化约束。在标准基准上的大量实验表明，DDG 有效缓解了灾难性过拟合与鲁棒性-准确率权衡。
英文原文摘要 1635 字符
Fast Adversarial Training (FAT) has proven effective in enhancing model robustness by encouraging networks to learn perturbation-invariant representations.However, FAT often suffers from catastrophic overfitting (CO), where the model overfits to the training attack and fails to generalize to unseen ones. Moreover, robustness-oriented optimization typically leads to notable performance degradation on clean inputs, and such degradation becomes increasingly severe as the perturbation budget grows.In this work, we conduct a comprehensive analysis of how guidance strength affects model performance by modulating perturbation and supervision levels across distinct confidence groups.The findings reveal that low-confidence samples are the primary contributors to CO and the robustness-accuracy trade-off. Building on this insight, we propose a Distribution-aware Dynamic Guidance (DDG) strategy that dynamically adjusts both the perturbation budget and supervision signal. Specifically, DDG scales the perturbation magnitude according to the sample confidence at the ground-truth class, thereby guiding samples toward consistent decision boundaries while mitigating the influence of learning spurious correlations. Simultaneously, it dynamically adjusts the supervision signal based on the prediction state of each sample, preventing overemphasis on incorrect signals. To alleviate potential gradient instability arising from dynamic guidance, we further design a weighted regularization constraint.Extensive experiments on standard benchmarks demonstrate that DDG effectively alleviates both CO and the robustness-accuracy trade-off.