PaperlayerView exact revision on arXiv

Source-linked AI summary

Probabilistic Adversarial Training

Andi Zhang, Xingyu Zhao, Siddartha Khastgir

arXiv:2609.39798v1cs.LGcs.AIstat.ML

TL;DR

The paper addresses the gap between probabilistic adversarial attacks and systematic model defense. It proves a KL-based lower bound on probabilistic robustness and uses it to derive Probabilistic Adversarial Training. PAT consistently improves PR, and its scaling factor can also enhance traditional non-probabilistic defenses.

  • Problem

    Earlier probabilistic adversarial attacks were confined to targeted attacks and example generation, leaving systematic defense unexplored; directly computing PR is generally intractable.

    Source: §1 · p. 1

  • Method

    The paper proves that KL(pdis∥pvic)−log Zvic lower-bounds PR and maximizes this objective as a tractable surrogate, yielding a scaled form of adversarial training called PAT.

    Source: §1 · pp. 1–2

  • Results

    PAT consistently improves PR, and its derived scaling factor can enhance non-probabilistic methods such as PGD-based adversarial training.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The KL lower bound gives adversarial training a probabilistic interpretation and a principled route to improving PR.

    Source: §1 · pp. 1–2

    Directly optimizing the ideal objective is problematic because its parameter-dependent sampling distribution makes differentiation unstable and requires complex score-function estimators.

    Source: §5.1 · p. 5

Abstract

from arXiv · show

Building on a probabilistic perspective in which adversarial examples arise from the overlap between a distance-based distribution $p_{\mathrm{dis}}$ and a victim-classifier-induced distribution $p_{\mathrm{vic}}$, we start from a simple intuition: adversarial examples become harder to generate when these two distributions are pushed apart, as their overlap becomes smaller, thereby increasing robustness. This intuition naturally motivates a KL-based robustness objective. We then prove that $\mathrm{KL}(p_{\mathrm{dis}}\|p_{\mathrm{vic}})-\log Z_{\mathrm{vic}}$ is a lower bound on probabilistic robustness (PR), where $Z_{\mathrm{vic}}$ denotes the normalizing constant of $p_{\mathrm{vic}}$. Since PR is generally intractable to compute directly, maximizing this KL-based lower bound provides a tractable surrogate objective for improving PR. We further show that this objective recovers a scaled form of adversarial training, offering a probabilistic interpretation of adversarial training and a principled route to robustness improvement. We call the resulting method probabilistic adversarial training. Experiments show that it consistently improves PR, and ablation studies demonstrate that the induced scaling factor can even enhance the PR of non-probabilistic adversarial training methods.

1 INTRODUCTION

The paper unifies probabilistic adversarial attacks with probabilistic robustness, deriving a KL-based lower bound and using it to motivate Probabilistic Adversarial Training. It reports improved PR and shows that the derived scaling factor can also enhance traditional defenses.

1 INTRODUCTION

  • The framework addresses a gap: prior probabilistic attacks were confined to targeted attacks and adversarial-example generation, while systematic defense remained unexplored.The paper combines that attack perspective with probabilistic robustness, defined as the probability that a classifier resists perturbations drawn from a specified distribution.Source: §1 · p. 1
  • KL(pdis∥pvic)−log Zvic is proved to be a lower bound on PR, and maximizing it gives a tractable surrogate because direct PR optimization is generally intractable.Zvic is the normalizing constant of pvic.Source: §1 · pp. 1–2
  • The motivating intuition is that adversarial examples arise from overlap between pdis, which constrains perturbation size, and pvic, which encourages misclassification.Maximizing their KL divergence pushes the distributions apart, shrinking the overlap and making jointly distance-constrained, misclassifying samples harder to draw.Source: §1 · pp. 1–2
  • PAT consistently improves PR, and its theoretical scaling factor can enhance non-probabilistic defenses such as PGD-based adversarial training.The contributions also report an importance-sampling formulation that makes bound estimation tractable.Source: §1 · p. 2
  • The paper formalizes untargeted probabilistic attacks and presents PAT as a scaled form of adversarial training with a probabilistic interpretation.Its contributions also state that maximizing the lower bound is theoretically guaranteed to improve PR.Source: §1 · p. 2

2 PRELIMINARIES

The preliminaries define adversarial attacks and their probabilistic formulation, then introduce probabilistic robustness and adversarial training as the evaluation and defense frameworks used in the paper.

2.1 ADVERSARIAL ATTACK

  • An adversarial attack seeks a nearby input that either causes any misclassification or forces a specified target label.The constrained objective can be relaxed using trade-off constants and a loss chosen to minimize target-label loss or maximize loss on the true label.Source: §2.1 · p. 2

2.2 PROBABILISTIC ADVERSARIAL ATTACK

  • The probabilistic attack framework uses Langevin dynamics to obtain samples from an adversarial distribution combining a victim distribution and a distance distribution.The cited framework focuses on targeted attacks; the distance distribution can take forms such as Laplace, Gaussian, or L∞-spherical depending on the distance measure.Source: §2.2 · pp. 2–3

2.3 PROBABILISTIC ROBUSTNESS

  • Probabilistic robustness is the probability that an attack fails under perturbations drawn from a specified distribution around a clean input.The attack-success event is defined through a logit-margin violation, and robustness is the complementary probability.Source: §2.3 · p. 3

2.4 ADVERSARIAL TRAINING

  • Adversarial training defends by augmenting training data with adversarial examples and optimizing a min-max robustness objective.The inner maximization is restricted to perturbations within a small distance budget around the original input.Source: §2.4 · p. 3

3 AN UNTARGETED VERSION OF PROBABILISTIC ADVERSARIAL ATTACK

This section extends the probabilistic attack formulation to the untargeted setting and establishes that its victim distribution is well-defined under stated conditions.

3 AN UNTARGETED VERSION OF PROBABILISTIC ADVERSARIAL ATTACK

  • Applying Langevin dynamics to the untargeted attack objective yields a Gibbs distribution concentrated around its solutions.The distance distribution is defined around the original input, and Proposition 1 establishes well-definedness of the untargeted victim density for continuous loss on [0, 1]^d and c>0.Source: §3 · p. 4
  • The paper uses squared L2 distance, making pdis Gaussian, and uses cross-entropy loss to sample adversarial examples from padv.The Langevin-dynamics sampling algorithm is presented in Algorithm 1.Source: §3 · p. 4

4 A KL-BASED LOWER BOUND ON PROBABILISTIC ROBUSTNESS

The section links probabilistic robustness to a KL-based objective by bounding the probability of attack failure. It motivates this result by connecting the attack-success region to cross-entropy loss.

4 A KL-BASED LOWER BOUND ON PROBABILISTIC ROBUSTNESS

  • Probabilistic robustness is evaluated under pdis, so the section’s objective is to maximize PR(pdis, s).The distance distribution introduced earlier serves as the perturbation evaluation distribution.Source: §4 · p. 4
  • A direct tractable mapping from logit-margin violation s(x) to cross-entropy loss f is difficult because of softmax nonlinearities and multiclass dynamics.The proof therefore defines the attack-success region Eadv by s(x)≥0 and γ* as the infimum of scaled cross-entropy loss over that region.Source: §4 · p. 4
  • Under the theorem’s stated conditions, PR is bounded using KL(pdis∥pvic)−log Zvic, with Zvic the normalizing constant of pvic.The result assumes γ*>0.Source: §4 · p. 4
  • The theorem unifies probabilistic attack and robustness perspectives by turning the intuition of separating pdis and pvic into a mathematical objective.Once the input and perturbation budget are fixed, pdis and its differential entropy are constant, so maximizing the lower bound requires maximizing KL(pdis∥pvic)−log Zvic.Source: §4 · p. 5

5 PROBABILISTIC ADVERSARIAL TRAINING

PAT turns a KL-based lower bound on probabilistic robustness into a tractable, importance-weighted adversarial-training objective. Its gradient estimator is asymptotically consistent, while a batch-level approximation uses smoothing to address weight collapse and regularize outliers.

5.1 DERIVING THE EMPIRICAL LOSS FUNCTION

  • Directly optimizing Jideal is unstable because padv depends on θ, so PAT differentiates the lower bound first and then importance-samples its gradient.This gradient-first step avoids differentiating through the parameterized sampling distribution.Source: §5.1 · p. 5
  • Self-normalized importance sampling cancels intractable constants and yields a Softmax-weighted empirical loss with weights held fixed during optimization.The batch weights are normalized, and their gradients are stopped.Source: §5.1 · pp. 5–6

5.2 CONNECTION TO STANDARD ADVERSARIAL TRAINING

  • PAT recovers standard adversarial training but replaces uniform sample weighting with self-normalized weights proportional to exp(−c2f(X(i), yori; θ)).The negative exponent down-weights extreme adversarial examples, unlike standard AT’s focus on worst-case perturbations.Source: §5.2 · p. 6

5.3 CONVERGENCE OF THE EMPIRICAL GRADIENT ESTIMATOR

  • As batch size B approaches infinity, the SNIS gradient estimator converges almost surely to the expected gradient under pdis, assuming its absolute gradient expectation is finite.The convergence statement concerns multiple perturbations for one clean image.Source: §5.3 · p. 6

5.4 BATCH-LEVEL APPROXIMATION AND IMPLICIT REGULARIZATION

  • The practical batch-level approximation generates one perturbation per clean image, although a strict joint-distribution estimator would require an intractable local adversarial volume.That volume matters for highly vulnerable samples; omitting it with a large c2 can collapse weights onto easy samples.Source: §5.4 · p. 7
  • A small smoothing factor β replaces c2 in the empirical weights to prevent collapse, while the batch-level formulation implicitly penalizes outliers and mislabeled data.The passage gives β = 0.001 as an example.Source: §5.4 · p. 7

6 EXPERIMENTS

PAT achieves higher probabilistic robustness than the evaluated baselines across the tested architectures and datasets, with a larger advantage at larger perturbation scales. Ablations support the importance of weighting and show a gain when the scaling is applied to PGD.

6.1 PROBABILISTIC ROBUSTNESS

  • PAT achieves superior PR across WRN-50-2 and ResNet-18 on CIFAR-10 and CIFAR-100, with a more pronounced advantage at larger perturbation scales.The results are summarized in Table 1.Source: §6.1 · p. 7, Table 1 · p. 8
  • PAT shows a nominal decrease in strictly worst-case PGD/CW accuracy compared with unweighted AT, alongside its reported PR advantage.The paper relates this trade-off to its weighting of extreme outliers.Source: §6.1 · p. 7

6.2 ABLATION STUDY

  • On CIFAR-100 (WRN-50-2), removing the importance weight drops PR(0.2) from 67.12% to 63.98%.PAT consistently outperforms PAT(WOS), which removes the weighting factor.Source: §6.2 · p. 7
  • On CIFAR-100, applying the importance weight to standard PGD raises PR(0.2) from 58.99% to 62.21%.The passage describes the weight as a plug-in regularizer.Source: §6.2 · p. 7
  • FGSM-COR exhibits more irregularity; the paper attributes this to FGSM’s lack of iterative exploration and stochasticity for evaluating the local adversarial distribution.The passage contrasts this with consistent gains in PGD-COR.Source: §6.2 · p. 8

7 RELATED WORK

Prior work addresses worst-case robustness and probabilistic robustness assessment, but dedicated PR-training frameworks remain sparse. Existing PR-targeted defenses have reported difficulty maintaining competitive standard adversarial robustness, while PAT presents a theoretically grounded alternative.

  • Worst-case adversarial training methods include min-max optimization, regularization, logit pairing, and efficient training variants, but the passage says extreme-outlier focus can compromise standard accuracy and distributional security.The passage also cites theoretical analysis of AT feature-learning dynamics by Li & Li (2024).Source: §7 · p. 8
  • PR assessment has developed through scalable estimators, probabilistic verification, and functional-perturbation extensions, while dedicated frameworks that directly optimize PR remain sparse.The cited works include Webb et al. (2018), Tit et al. (2021), Karim et al. (2023), Weng et al. (2019), and Zhang et al. (2022).Source: §7 · pp. 8–9
  • Prior PR-targeted defenses include random perturbations and CVaR- or EVaR-based training; the passage reports difficulty maintaining competitive standard adversarial robustness.AT-PR is described as using heuristic gradient-based boundary search, whereas PAT formalizes untargeted attacks, proves a KL lower bound, and derives an SNIS objective.Source: §7 · p. 9

8 CONCLUSION

The conclusion presents PAT as a unified probabilistic defense framework built on a KL lower bound and SNIS, with reported PR improvements across architectures. The appendix pseudocode gives its two-stage training procedure: generate probabilistic adversarial examples, then update model parameters using weighted loss.

8 CONCLUSION

  • The conclusion presents KL(pdis||pvic) − log Zvic as a lower bound on PR and PAT as its SNIS-based optimization, with importance weighting that penalizes extreme worst-case outliers.The paper reports that PAT consistently enhances PR across architectures.Source: §8 · p. 9

A PSEUDO CODE OF THE ALGORITHMS

  • Algorithm 2 alternates probabilistic adversarial-example generation with a model update using detached, smoothed Softmax weights over the batch.The pseudocode identifies β as the smoothing factor and applies the weighted loss to update θ.Source: A PSEUDO CODE OF THE ALGORITHMS · p. 12

B PROOFS OF THEOREMS IN THE MAIN TEXT

The proofs establish a KL-based lower bound on probabilistic robustness and derive an equivalent classifier objective. They also show that the self-normalized gradient estimator converges to the objective’s true gradient.

Proposition 1: Well-definedness of the untargeted victim distribution

  • The victim distribution is a well-defined probability density because its normalizing constant is positive and finite.Continuity on the compact input domain makes the exponential loss bounded and measurable.Source: B PROOFS OF THEOREMS IN THE MAIN TEXT · pp. 12–13

Theorem 2: KL-Based Lower Bound on Probabilistic Robustness

  • KL(pdis||pvic)-log Zvic lower-bounds probabilistic robustness under the theorem’s stated assumptions.The proof connects the expected loss under pdis to the vulnerable-region probability and uses PR(pdis,s)=1-I[pdis,s].Source: B PROOFS OF THEOREMS IN THE MAIN TEXT · p. 13

Proposition 3: Idealized Objective

Theorem 5: Asymptotic Consistency of the SNIS Gradient Estimator

  • As batch size B approaches infinity, the self-normalized importance-sampling gradient estimator converges almost surely to the true expected gradient under pdis.This conclusion assumes the expected gradient under pdis is finite.Source: B PROOFS OF THEOREMS IN THE MAIN TEXT · pp. 14–15

C THEORETICAL ANALYSIS OF THE BATCH-LEVEL ESTIMATOR

The appendix analyzes the batch-level estimator used by Algorithm 2, discusses the global role of Zvic, and records experiment settings. It characterizes the estimator’s large-batch limit and the robustness bound preserved by smoothing.

C THEORETICAL ANALYSIS OF THE BATCH-LEVEL ESTIMATOR

  • Algorithm 2’s batch-level estimator is consistent, with a limit given by an entropic-risk gradient under vulnerability-based data reweighting.The omitted local adversarial-volume factor reappears in the limit and down-weights clean pairs according to the exponential moment of loss over their perturbation neighborhoods.Source: C THEORETICAL ANALYSIS OF THE… · pp. 15, 17
  • For every admissible β, the smoothed objective still lower-bounds probabilistic robustness, with Theorem 2 giving the tightest member of the bound family.The analysis assumes γ* > 0 for the clean pair.Source: C THEORETICAL ANALYSIS OF THE… · pp. 15, 20

D FURTHER DISCUSSION ON THE GLOBAL VULNERABILITY CAPACITY Zvic

  • The −log Zvic term acts as a global regularizer: local vulnerability reduction can raise vulnerability elsewhere, so the objective balances both effects.The discussion links the smoothing factor β to managing this redistribution pressure and preventing weight collapse.Source: D FURTHER DISCUSSION ON THE GLOBAL… · p. 22

E DETAILS OF THE EXPERIMENTS

  • The appendix provides experimental settings, hyperparameters, and evaluation protocols intended to support reproduction of the Section 6 results.Source: E DETAILS OF THE EXPERIMENTS · p. 22

E.1 BASIC TRAINING SETUP

  • CIFAR-10 and CIFAR-100 training uses reflection padding, random crops and flips, 100 epochs, and batches of 256.The setup specifies SGD with Nesterov momentum 0.9 and weight decay 5 × 10^-4, with learning-rate drops at epochs 75 and 90.Source: §E.1 · p. 22

E.2 HYPERPARAMETERS OF PROBABILISTIC ADVERSARIAL TRAINING

  • PAT’s main experiments use 100 Langevin steps, step size 0.3, noise scale 0.001, and smoothing factor β = 0.001.The listed energy weights are c1 = 0.3 and c2 = 0.42.Source: §E.2 · p. 23

E.3 BASELINES AND EVALUATION PROTOCOL

The evaluation protocol specifies standard and probabilistic robustness tests alongside baseline training settings. The limitations section notes that probabilistic attacks typically cost more because they require more generation steps.

E.3 BASELINES AND EVALUATION PROTOCOL

  • Standard robustness is evaluated with 20-step PGD and CW attacks at ε = 8/255 and α = 2/255.Source: §E.3 · p. 23
  • Probabilistic robustness is estimated using 100 perturbations per image at test-time scales ε ∈ {0.1, 0.12, 0.15, 0.2}.Source: §E.3 · p. 23
  • PGD-AT and TRADES baselines use their original implementations and 10-step training attacks bounded by L∞≤8/255.Source: §E.3 · p. 23

E.4 COMPUTE RESOURCES

  • A PAT training run on CIFAR-10 takes about 7 minutes per epoch on one NVIDIA RTX 5090 GPU.Source: §E.4 · p. 23

F LIMITATIONS

  • Probabilistic attacks typically require more generation steps than conventional attacks, increasing computational cost.Source: F LIMITATIONS · p. 23

Related papers

Loading 2609.39798v1…