PaperlayerView exact revision on arXiv

Source-linked AI summary

ExGrad: Beyond Suppression - Explicit Clean-Gradient Subtraction in Adversarial Training

Zhiyuan Ye, Xiangyu Zhou, Ji Qi, Hao Zhang, Yi Zhou

arXiv:2610.30018v1cs.LG

TL;DR

Adversarial-training gradients descend their source losses but do not directly reveal their effect on adversarial margins. ExGrad measures finite-step margin responses to clean, adversarial-input, and AWP gradients and recomposes them over a bounded affine domain. Across three datasets, suitable radii improve principal robustness metrics over AWP, while clean-gradient subtraction and its strength vary with the radius.

  • Problem

    Source-loss descent does not directly characterize an update’s effect on adversarial margins, and gradient norms or pairwise angles do not measure those effects on the target geometry.

    Source: Introduction · p. 1

  • Method

    ExGrad probes finite-step adversarial-margin responses to clean, adversarial-input, and AWP gradients, then selects a bounded affine recomposition whose coefficients can be negative.

    Source: Introduction · p. 2

  • Results

    Suitable radii improve principal robustness metrics over AWP on CIFAR-10, CIFAR-100, and ImageNet-100.

    Source: Introduction · p. 2, Conclusion · p. 7

  • Takeaways & Limitations

    Clean-gradient subtraction is a measured rather than prescribed update preference, and increasing the affine radius suppresses the realized clean-axis component while shifting the clean–PGD operating point.

    Source: Conclusion · p. 7

    The response objective is attack dependent: larger R favors PGD and APGD-CE, while moderate radii transfer better to APGD-T and AutoAttack.

    Source: Discussion · p. 7

Abstract

from arXiv · show

Adversarial training derives updates from surrogate losses, but source-loss descent does not directly characterize an update's effect on adversarial margins. We introduce ExGrad (extrapolative gradient recomposition), which constructs clean-input, adversarial-input, and adversarial-weight-perturbed (AWP) gradients. Virtual steps measure their margin responses, and a globally solvable three-variable problem selects coefficients over a bounded affine domain without nonnegativity constraints. Across affine radii on CIFAR-10, negative clean coefficients rapidly predominate and increase in magnitude with the radius. Cross-zero interventions show that setting the clean coefficient to zero is insufficient: mild subtraction improves PGD-20, while stronger subtraction trades clean accuracy for further PGD-20 gains. In CIFAR-10 WRN-28-4 controls, none of the three candidate-removal variants matches full ExGrad. Projection diagnostics show that negative clean coefficients usually coexist with positive net clean-axis projections, although both decrease as the radius grows. Norm-matched controls indicate that update magnitude alone does not explain the moderate-radius gains. Experiments on CIFAR-10, CIFAR-100, and ImageNet-100 show radius-dependent improvements over AWP. On CIFAR-100, ExGrad at $R=0.8$ improves all five reported metrics, including clean and AutoAttack accuracy by 3.84 and 1.75 percentage points. On ImageNet-100, the same radius improves all four robust metrics over both AWP and PGD-AT. These results identify clean-gradient subtraction as a response-revealed update preference whose strength and clean-robust operating point are controlled by the affine radius.

Introduction

ExGrad addresses the gap between a gradient’s source-loss descent and its effect on adversarial margins by measuring candidate updates before recomposing them. Its evaluations identify response-supported clean-gradient subtraction and radius-dependent robustness improvements over AWP.

Introduction

  • ExGrad probes clean, adversarial-input, and AWP gradients from the same nominal parameters, measures finite-step margin responses, then solves a bounded affine recomposition.Its lightweight convex, batch-wise solver allows negative coefficients; virtual parameters are restored, and only the recomposed direction advances the optimizer.Source: Introduction · p. 2
  • A majority of mini-batches select a negative clean coefficient early in training, and the proportion rapidly approaches one; setting it to zero does not match mild subtraction’s robustness profile.The adversarial and AWP coefficients remain response-adaptive in the cross-zero intervention.Source: Introduction · p. 2
  • As R grows, both the clean coefficient and net clean-axis projection decrease; complete reversal remains rarer and appears mainly at the largest radius late in training.A negative clean coefficient alone does not imply a negative net clean-axis component because the other gradients can also project onto that axis.Source: Introduction · p. 2
  • Norm-matched controls preserve the directional effect after matching the recomposed update to the AWP gradient norm, although magnitude contributes to part of the gain at larger R.The study uses norm-matched controls to delimit scale-based explanations.Source: Introduction · p. 2
  • Suitable radii improve principal robustness metrics over AWP on CIFAR-10, CIFAR-100, and ImageNet-100.Reported gains include all four robustness metrics on CIFAR-10 with WRN-34-10, all five reported metrics on CIFAR-100, and all four robustness metrics on ImageNet-100.Source: Introduction · p. 2

Related Work

Prior approaches regulate source objectives, gradient geometry, or example weighting; ExGrad instead evaluates candidate updates against a shared adversarial-margin target. Its related-work context spans robust objectives, parameter-neighborhood methods, gradient recomposition, and virtual-step response signals.

Related Work

  • Robust-training objectives regulate how source losses generate updates, whereas ExGrad measures how candidate updates change the current adversarial margin.TRADES regulates natural and boundary errors through an objective-level coefficient (Zhang et al. 2019).Source: Related Work · p. 2
  • AWP adds parameter-neighborhood information to PGD-AT, while ExGrad retains the AWP state as a candidate rather than prescribing its weight (Wu, Xia, and Wang 2020).The passage also situates AWP alongside sharpness-aware minimization (Foret et al. 2021).Source: Related Work · pp. 2–3
  • Multi-objective and conflict-aware methods use source-gradient geometry or joint-descent conditions, while ExGrad permits negative coefficients and need not descend every source loss.The passage cites multi-objective optimization and conflict-aware adversarial training as related approaches (Sener and Koltun 2018; Chen et al. 2018; Yu et al. 2020; Liu et al. 2021; Xue et al. 2024).Source: Related Work · p. 3
  • Virtual-step and task-affinity methods measure effects on another objective, while ExGrad probes restored steps against the same mini-batch margin without a validation set.Its evaluation uses PGD, APGD-CE, APGD-T, and AutoAttack to guard against conclusions tied to a weak or single attack (Athalye, Carlini, and Wagner 2018; Croce and Hein 2020).Source: Related Work · p. 3

Method

ExGrad builds clean, adversarial, and AWP gradient candidates, probes their finite-step adversarial-margin responses, and selects a bounded affine recombination. The coefficient problem has a global optimum, while geometric diagnostics distinguish the clean coefficient from the full update’s clean-axis component.

Candidate Gradients from Nested Training States

  • The three candidates are clean, adversarial, and AWP gradients computed with perturbations held fixed; the AWP perturbation is removed before probing and the eventual update.All probes and the optimizer update act on the same nominal parameters.Source: Candidate Gradients from Nested… · p. 3

Finite-Step Adversarial-Margin Response

  • Each candidate is virtually applied from the same parameters, and its finite-step adversarial-margin response is measured before parameters are restored.The probe factor κ scales the optimizer learning rate η; this response targets margin change rather than source loss or candidate angles.Source: Finite-Step Adversarial-Margin Response · pp. 3–4

Bounded Affine Coefficient Solver

  • The solver chooses coefficients over a bounded unit-sum affine domain without requiring nonnegative coefficients, and its concave objective has a global optimum.The radius controls distance from the uniform affine combination; the guarantee applies to the local finite-step response predictor, not neural-network training as a whole.Source: Bounded Affine Coefficient Solver · p. 4

Training Procedure and Geometric Diagnostics

  • The training loop probes each direction, solves for coefficients, and commits one recomposed update; a negative clean coefficient denotes affine subtraction, not necessarily a negative net clean-axis component.ExGrad reuses AWP’s PGD examples and weight-perturbation construction, adding clean and nominal-adversarial backward passes, three margin-forward probes, and a negligible three-variable solve; it does not change model size or inference cost.Source: Training Procedure and Geometric… · p. 4

Experiments

ExGrad’s results vary with the affine radius across datasets and metrics, while its training trajectories remain stable and its clean-gradient coordinate becomes increasingly negative as the radius grows. Experiments also distinguish that coordinate from the update’s net clean-axis projection.

Experimental Setup

  • The experiments cover CIFAR-10, CIFAR-100, and ImageNet-100 with WRN-28-4, plus WRN-34-10 on CIFAR-10; all models train for 200 epochs.CIFAR uses PGD-10 training and PGD-20 evaluation; ImageNet-100 uses PGD-2 training and PGD-10 evaluation.Source: Experimental Setup · p. 4

Main Robustness Results

  • On CIFAR-10 with WRN-28-4, R = 0.8 improves four metrics over AWP while APGD-CE is 0.23 points lower; R = 1.0 raises PGD-20 and APGD-CE by 2.47 and 1.84 points.At R = 1.0, clean and targeted robustness decline relative to AWP.Source: Main Robustness Results · p. 5
  • At R = 0.8, ExGrad improves all four robustness metrics over AWP by 0.45, 0.59, 0.48, and 0.47 points for PGD-20, APGD-CE, APGD-T, and AutoAttack.At R = 1.0, PGD-20 and APGD-CE gains increase to 3.25 and 2.65 points, while APGD-T and AutoAttack favor the smaller radius.Source: Main Robustness Results · p. 5
  • At R = 0.8, ExGrad gains 3.84 points in clean accuracy and 1.75 in AutoAttack accuracy over AWP on CIFAR-100, and beats both baselines on all four ImageNet-100 robust metrics.The CIFAR-100 gains cover all five reported metrics; on ImageNet-100, R = 0.8 also exceeds PGD-AT on every robust metric.Source: Main Robustness Results · p. 5

Training Dynamics Against Baselines

  • PGD-AT’s PGD-20 accuracy declines after epoch 100, whereas AWP reduces robust overfitting and ExGrad maintains higher PGD-20 accuracy through most of the second half of training.ExGrad’s clean trajectory remains below AWP; the plotted panels show PGD-20 above and clean accuracy below, using three-epoch moving averages.Source: Training Dynamics Against Baselines · p. 6, Figure 2 · p. 6

Explicit and Effective Clean-Gradient Subtraction

  • Across R = 0.8, 1.0, and 1.2, the mean clean coefficient becomes negative early, with its magnitude increasing as R grows.At R = 0.8, 58.4% of mini-batches have βclean < 0 at epoch 1, and the fraction rapidly approaches 100%.Source: Explicit and Effective Clean-Gradient… · p. 6, Figure 3 · p. 6
  • Despite negative βclean, the net clean-axis projection remains positive at R = 0.8 and 1.0; at R = 1.2, negative projections occur in 22.28% of mini-batches over epochs 151–200.Mean pclean over those epochs is 0.732, 0.270, and 0.145 for R = 0.8, 1.0, and 1.2, respectively.Source: Explicit and Effective Clean-Gradient… · p. 6, Figure 3 · p. 6

Candidate Complementarity and the Zero-Clean Boundary

At R = 1, full ExGrad outperforms each candidate-removal variant, while cross-zero controls show PGD-20 rising as the clean coefficient becomes negative. Norm-matched controls and training-cost measurements further characterize the update and its implementation cost.

Candidate Complementarity and the Zero-Clean Boundary

Direction Versus Update Magnitude

  • From R = 0.8 to 1.2, norm-matched PGD-20 rises from 56.58% to 58.86%, while clean accuracy falls from 83.81% to 79.92%.Matching update magnitude does not explain the moderate-radius gain or the clean–PGD operating-point shift.Source: Direction Versus Update Magnitude · p. 7, Table 3 · p. 7

Training Cost

  • ExGrad requires 1.45× AWP’s epoch time and 24.24 MiB more peak allocated memory, with no inference overhead.The benchmark uses a single H100 and excludes evaluation and I/O.Source: Training Cost · p. 7, Table 4 · p. 7

Discussion

Cross-zero and fixed-composition controls distinguish explicit subtraction from removal and show that response adaptation contributes beyond a single global composition. Coefficient signs and clean-axis projections describe different geometries, and radius preference varies by attack.

Discussion

  • Cross-zero controls show PGD-20 rising as βclean moves from 0.1 through zero to −0.2, while the fixed mean triplet recovers much, but not all, of the adaptive gain.This supports a response-preferred joint composition and a clean–robust operating-point shift, not the conclusion that clean fitting is globally harmful.Source: Discussion · p. 7
  • A negative βclean does not necessarily mean a negative clean-axis projection: projections are usually positive at R = 0.8 and 1.0, with only some late R = 1.2 batches reversing.Coordinate subtraction is broad; complete clean-axis reversal is more selective.Source: Discussion · p. 7
  • The response objective is attack dependent: larger R favors PGD and APGD-CE, while moderate radii transfer better to APGD-T and AutoAttack.The local oracle omits momentum trajectories, targeted-attack candidates, and alternative parameter-neighborhood directions.Source: Discussion · p. 7

Conclusion

ExGrad recomposes gradients using finite-step adversarial-margin responses, and its suitable radii improve robustness over AWP across three datasets. The findings characterize clean-gradient subtraction as a measured update preference whose strength and clean–robust operating point vary with affine radius.

Conclusion

  • Suitable radii improve robustness over AWP on CIFAR-10, CIFAR-100, and ImageNet-100, while increasing R lowers βclean and pclean and shifts the clean–PGD operating point.The conclusion characterizes clean-gradient subtraction as a measured, rather than prescribed, update preference.Source: Conclusion · p. 7

Related papers

Loading 2610.30018v1…