Newest papers

ExGrad: Beyond Suppression - Explicit Clean-Gradient Subtraction in Adversarial Training

Zhiyuan Ye, Xiangyu Zhou, Ji Qi, Hao Zhang, Yi Zhou · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30018 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

Adversarial ラジオ クリーン トレーニング サブネットは代替損失からアップデートを生み出しますが、ソース 損失の下落は対抗ラジオ マージンにアップデートの効果を直接特徴づけることはありません。 私たちは ExGrad (extrapolative gradient clean control) を導入し、CIFAR-10 でクリーン インプット、adversarial-affine インプット、および adversarial-weight-perturbed (AWP) グレディンを構築します。 仮想ステップはそのマージン 応答を測定し、グローバルで解決可能な 3 個のラジオ 変数の問題を 0 に設定することを示すクロスゼロ介入は不十分です:

Machine translation (Meta M2M100); the English original follows.

Abstract

Adversarial training derives updates from surrogate losses, but source-loss descent does not directly characterize an update's effect on adversarial margins. We introduce ExGrad (extrapolative gradient recomposition), which constructs clean-input, adversarial-input, and adversarial-weight-perturbed (AWP) gradients. Virtual steps measure their margin responses, and a globally solvable three-variable problem selects coefficients over a bounded affine domain without nonnegativity constraints. Across affine radii on CIFAR-10, negative clean coefficients rapidly predominate and increase in magnitude with the radius. Cross-zero interventions show that setting the clean coefficient to zero is insufficient: mild subtraction improves PGD-20, while stronger subtraction trades clean accuracy for further PGD-20 gains. In CIFAR-10 WRN-28-4 controls, none of the three candidate-removal variants matches full ExGrad. Projection diagnostics show that negative clean coefficients usually coexist with positive net clean-axis projections, although both decrease as the radius grows. Norm-matched controls indicate that update magnitude alone does not explain the moderate-radius gains. Experiments on CIFAR-10, CIFAR-100, and ImageNet-100 show radius-dependent improvements over AWP. On CIFAR-100, ExGrad at $R=0.8$ improves all five reported metrics, including clean and AutoAttack accuracy by 3.84 and 1.75 percentage points. On ImageNet-100, the same radius improves all four robust metrics over both AWP and PGD-AT. These results identify clean-gradient subtraction as a response-revealed update preference whose strength and clean-robust operating point are controlled by the affine radius.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Background subtraction, Bounded function, Subtraction, Mathematics, Affine transformation, Measure (data warehouse)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange