PaperlayerView exact revision on arXiv

Source-linked AI summary

Sparse Fine-Tuning for Parameter-Efficient Adversarial Training

Zhaoxin Wang, Zihang Ding, Handing Wang

arXiv:2610.39455v1cs.LGcs.AI

TL;DR

Adversarial training is costly and can trade clean accuracy for robustness, while LoRA-based adaptation retains a robustness gap relative to full-parameter AT. SAFT selects robustness-critical parameters using adversarial gradient saliency and updates only those weights. Across architectures and datasets, it outperforms LoRA-based methods and approaches or surpasses full-parameter AT in robustness with about 5% of parameters trainable.

  • Problem

    Adversarial training incurs high memory costs and a clean–robust accuracy trade-off, while LoRA-based adversarial fine-tuning has a robustness gap relative to full-parameter AT.

    Source: §1 · p. 1

  • Method

    SAFT identifies robustness-critical parameters through adversarial gradient saliency, then updates only those parameters while freezing the rest.

    Source: §1 · p. 2

  • Results

    Across architectures and datasets, SAFT outperforms LoRA-based adversarial fine-tuning and approaches or surpasses full-parameter AT in robust accuracy while updating about 5% of parameters.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The findings support a sparse parameter-space view of robustness, with SAFT reducing optimizer-state, persistent-gradient, and peak training memory relative to full-parameter AT.

    Source: §1 · p. 2

    SAFT brings no wall-clock speedup or FLOP reduction over full-parameter AT because its unstructured sparsity does not accelerate passes on standard hardware.

    Source: §6 · p. 10

Abstract

from arXiv · show

Deep neural networks achieve strong performance across many tasks but remain vulnerable to adversarial perturbations. Adversarial training (AT) is one of the most effective defenses, yet it suffers from high memory cost on large models and the persistent clean-robust accuracy trade-off. Recent work introduces parameter-efficient fine-tuning, such as LoRA, into AT, but this constraint induces a notable robustness gap relative to full-parameter AT. In this work, we revisit parameter-efficient adversarial fine-tuning from a parameter space perspective. Through gradient analysis, we find that adversarial optimization is highly concentrated on a small subset of parameters, which we call Robustness-Critical Parameters (RCPs), suggesting that robustness is encoded in a sparse subspace. Building on this observation, we propose Sparse Adversarial Fine-Tuning (SAFT), which identifies RCPs via adversarial gradient saliency and performs AT by updating only these parameters while freezing the rest. Across architectures and datasets, SAFT outperforms LoRA-based methods in both clean and robust accuracy with fewer trainable parameters, and approaches or surpasses full parameter AT in robustness while updating only about 5\% of parameters.

1 Introduction

SAFT addresses adversarial training’s memory and clean–robust accuracy challenges by finding and updating a sparse subset of robustness-critical parameters. It outperforms LoRA-based adversarial fine-tuning and approaches or surpasses full-parameter adversarial training in robustness while updating about 5% of parameters.

1 Introduction

  • Adversarial training requires repeated forward and backward passes and can trade lower clean accuracy for greater robustness, while LoRA-based AT retains a robustness gap versus full-parameter AT.Prior trade-off methods act at the loss or data level, leaving parameter-space structure largely unexplored.Source: §1 · pp. 1–2
  • About 5% of parameters carry most cumulative adversarial-gradient mass, while over 90% remain near zero throughout training; this sparse subset is called RCPs.The RCPs are reported as consistent across attack types.Source: §1 · p. 2
  • SAFT identifies RCPs through adversarial gradient saliency, updates only those parameters, and freezes the rest.Identification occurs once before fine-tuning and requires no additional learnable importance scores.Source: §1 · p. 2
  • Across architectures and datasets, SAFT outperforms LoRA-based adversarial fine-tuning and approaches or surpasses full-parameter adversarial training in robust accuracy while updating about 5% of parameters.SAFT also reduces optimizer-state, persistent-gradient, and peak training memory relative to full-parameter AT.Source: §1 · p. 2

2 Related Work

Prior work reduces adversarial-training cost through faster perturbation generation or parameter-efficient adaptation, addresses clean–robust trade-offs through loss or data changes, and studies parameter sparsity in other settings.

2.1 Efficient Adversarial Training

  • Efficient AT methods accelerate adversarial-example generation, while LoRA-based PEFT limits trainable parameters to reduce memory costs for transformer adaptation.FastAT uses single-step FGSM but suffers catastrophic overfitting; other methods stabilize single-step training or reuse gradients and perturbations.Source: §2.1 · pp. 2–3

2.2 Accuracy-Robustness Trade-off

  • Trade-off methods balance clean and robust performance through regularized objectives, example reweighting, additional unlabeled data, or other changes to training.Prior explanations link the conflict to data distributions and non-robust predictive features.Source: §2.2 · p. 3

2.3 Parameter-Space Sparsity in Robustness

  • Selective fine-tuning, pruning, and subnetwork work indicate that model capabilities can be concentrated in a subset of parameters.Examples include Diff pruning, PaFi, LT-SFT, and the lottery ticket hypothesis.Source: §2.3 · p. 3

3 Empirical Findings

In a pretrained ViT-B on CIFAR-10, adversarial-gradient saliency is concentrated in a small parameter subset, and intervening on that subset sharply damages robust accuracy. These findings motivate SAFT’s sparse updates.

3.1 Adversarial Gradients Concentrate on Few Parameters

  • The top 5% of parameters capture 67.7% of adversarial-gradient saliency in ViT-B, far above the 5% expected under a uniform distribution.The study accumulates and normalizes parameter saliency under the adversarial loss during AT.Source: §3.1 · pp. 3–4, §3 · p. 3, Figure 1 · p. 4

3.2 High-Gradient Parameters Are Critical for the Robust Model

  • Masking the top 5% high-gradient parameters lowers robust accuracy from 43.60% to 3.70%, while masking a random 5% lowers it to 39.48%.Clean accuracy also falls after masking high-gradient parameters, but the relative robust-accuracy loss is substantially larger.Source: §3.2 · p. 4, Table 1 · p. 4
  • The intervention and gradient distribution identify RCPs as both statistically salient and causally critical for robust behavior, motivating SAFT’s updates to that subset while freezing other parameters.The remaining pretrained weights are left unchanged.Source: §3.2 · p. 4

4 Method

SAFT identifies robustness-critical parameters using adversarial gradient saliency, then performs adversarial fine-tuning by updating only those parameters while freezing the rest. Its mask is selected during calibration and fixed during training, concentrating updates in the original model’s parameter space.

4 Method

  • SAFT updates only robustness-critical parameters (RCPs), freezing all other pretrained parameters while retaining the original architecture and adding no adapter modules.It directly selects a sparse subset of the original parameters rather than adding low-rank adapters or changing the inference architecture.Source: §4 · p. 4, §4.3 · p. 5

4.1 Formulation

  • The formulation uses a binary mask to mark trainable parameters, and SAFT constructs that mask from adversarial gradient saliency.The mask determines which parameters receive updates under the adversarial training loss.Source: §4.1 · p. 5

4.2 Robustness-Critical Parameter Identification

  • During calibration, SAFT accumulates each parameter’s adversarial gradient magnitude and selects the top ρ fraction by saliency as RCPs.The calibration gradients use adversarial perturbations generated against the current model by the same attack used for adversarial training.Source: §4.2 · p. 5
  • SAFT computes the mask once during calibration and fixes it throughout adversarial training; for transformers, its search is restricted to attention projections and feed-forward linear layers.The searched modules are WQ, WK, WV, and WO in self-attention, plus Wup and Wdown in feed-forward networks.Source: §4.2 · p. 5

4.3 Sparse Adversarial Fine-Tuning

  • After selecting RCPs, SAFT can use PGD-AT, TRADES, or MART losses without changing the adversarial objective itself.Only the update space changes; non-RCP parameters remain at their pretrained values.Source: §4.3 · p. 5
  • SAFT reduces persistent-gradient and optimizer-state memory, but its backward pass still computes the full gradient and therefore does not reduce AT FLOPs.The memory savings come from maintaining gradients and optimizer states only for the selected parameter fraction.Source: §4.3 · p. 5

5 Experimental Results

Experiments across architectures, datasets, attack methods, and training objectives show that SAFT can retain robust accuracy with sparse parameter updates. Its performance is accompanied by stable attack-derived parameter selection, lower peak memory than Full AT, and a clean-accuracy trade-off.

5.2 Main Results across Architectures

  • On CIFAR-10, SAFT beats LoRA-based PEFT-AT across three backbones while using fewer trainable parameters; on ViT-B, it surpasses Full AT under all four attacks with 3.6% of parameters.On ViT-B, it improves over LoRA by 3.04% in clean accuracy and 2.83% on PGD-20; on Swin-B, it improves by 3.67% on PGD-20 and 3.35% on AutoAttack, with comparable clean accuracy.Source: §5.2 · p. 6, Table 2 · p. 7

5.3 Main Results across Datasets

  • On TinyImageNet, SAFT reaches 18.01% PGD-20 and 14.34% AutoAttack accuracy, improving over LoRA by more than 11% and 9%, while remaining close to Full AT across datasets.The LoRA robustness gap grows with dataset complexity; on CIFAR-100, SAFT slightly exceeds Full AT on PGD-20 and PGD-100.Source: Table 3 · p. 7, §5.3 · pp. 7–8

5.4 Robustness Critical Parameter under Different Attacks

  • Across attack pairs, RCP overlap ranges from 82.82% to 92.42%; PGD-20 and PGD-100 overlap by 92.42%, well above the 5% expected for arbitrary subsets.The authors interpret this consistency across structurally different attacks as evidence that RCPs reflect model structure rather than the selection attack.Source: Table 4 · p. 8, §5.4 · p. 8

5.5 Specificity of Robustness Critical Parameters

  • With the same 5% parameter budget, adversarial saliency exceeds clean-data gradient saliency by 28.2 points in clean accuracy and 19.1 points on PGD-20.RCPs overlap only 5.27% with the top weight-magnitude subset and 30.94% with the top clean-gradient subset; zeroing RCPs reduces PGD-20 accuracy by 86.0% relative, versus 57.8% for weight-magnitude parameters and 10.2% for random parameters.Source: Table 5 · p. 8, §5.5 · p. 8

5.6 Generalization Across AT Objectives

  • Across PGD-AT, TRADES, and MART, SAFT outperforms LoRA-based PEFT-AT; under TRADES it surpasses Full AT on PGD-20 and PGD-100, while under MART it trails Full AT by 3.5–4.7% across attacks.Under MART, SAFT remains the strongest PEFT-AT method; DoRA still trails SAFT despite a larger trainable budget, consistent with its rank-r constraint.Source: §5.6 · pp. 8–9, Table 6 · p. 9, Table 7 · p. 9

5.7 Effect of Robustness Critical Parameter Percentage

  • With 1% of parameters selected, SAFT achieves 43.71% PGD-20 and 40.82% AutoAttack; increasing the budget to 5% raises these to 44.41% and 41.61%, with marginal robustness gains beyond 5%.Between 5% and 7%, PGD-20 changes from 44.41% to 44.71%, while CW-20 is unchanged at 44.87%.Source: Table 8 · p. 9, §5.7 · p. 9

5.8 Training Cost and Further Analysis

  • On ViT-B, SAFT reduces peak memory by 0.97 GiB versus Full AT and 0.55 GiB versus LoRA; its time per step matches Full AT and is 32% lower than LoRA.Parameter-side savings grow linearly with model size; under Adam they reach 2.18 and 4.54 GiB for ViT-L and ViT-H, respectively.Source: Table 9 · p. 9, §5.8 · pp. 9–10
  • The RCP mask overlap with its calibration mask falls from 95.65% after epoch 1 to 55.73% at epoch 10, then stabilizes; under distribution shifts, SAFT has higher clean and PGD-20 accuracy than LoRA.Across the evaluated shifts, SAFT has the highest PGD-20 accuracy among adapted models and never has a larger relative accuracy drop than LoRA; the static mask is described as workable rather than optimal.Source: Table 10 · p. 9, §5.8 · p. 10, Table 11 · p. 10

6 Conclusion

SAFT identifies a sparse robustness-relevant parameter subset and fine-tunes only that subset, achieving strong robust accuracy with fewer than 5% of parameters updated. Its limitations include no wall-clock or FLOP reduction and a remaining clean-robust accuracy trade-off.

6 Conclusion

  • Across three architectures, three datasets, and three AT objectives, SAFT outperforms LoRA-based PEFT-AT and approaches or surpasses full-parameter AT in robustness while updating fewer than 5% of parameters.SAFT also reduces optimizer-state, persistent-gradient, and peak training memory.Source: §6 · p. 10
  • Gradient analysis finds adversarial optimization concentrated in a sparse subset called RCPs, and masking analysis shows this subset is causally critical for robust behavior.SAFT identifies RCPs through adversarial gradient saliency and updates only these parameters.Source: §6 · p. 10
  • SAFT brings no wall-clock speedup or FLOP reduction over full-parameter AT, and its clean accuracy remains below full-parameter AT in most settings.The implementation uses unstructured sparsity; the static RCP mask is not periodically re-selected despite about half of it drifting during training.Source: §6 · p. 10

A Memory Scaling of the Parameter Side

SAFT reduces parameter-side optimizer-state memory by storing optimizer state only for trainable parameters, while weights and transient gradients remain. The relative importance of parameter memory grows for larger backbones, smaller batches, and gradient checkpointing.

A Memory Scaling of the Parameter Side

  • SAFT uses at most 8N + 4kρN bytes for weights, transient gradients, and optimizer state, versus 4N + 4N + 4kN bytes for full-parameter AT.The resulting saving is at least 4kN(1 − ρ), depending on model size and optimizer order.Source: A Memory Scaling of the Parameter Side · p. 14
  • Table 12 extrapolates analytic parameter-side memory for Full AT and SAFT to larger backbones using the ViT-B trainable fraction ρ ≈ 3.6% and Adam with k = 2.For SGD with momentum (k = 1), used in the experiments, the saving is halved.Source: A Memory Scaling of the Parameter Side · p. 14, Table 12 · p. 14
  • Parameter memory grows as d^2L, while activation memory grows as B T d L, making the measured large-batch, short-sequence setting least favorable to SAFT.For larger backbones, smaller batches, and gradient checkpointing, the parameter side becomes dominant.Source: A Memory Scaling of the Parameter Side · p. 14

B Other Datasets and a Convolutional Backbone

Adversarial saliency concentrates on a small parameter subset across datasets, though concentration is weaker on ResNet-50 than on ViT-B. On ResNet-50/CIFAR-10, SAFT slightly exceeds Full AT in PGD-20 accuracy.

B Other Datasets and a Convolutional Backbone

C Zeroing Interventions on the SAFT Model

Zeroing RCPs in a trained SAFT model causes the largest damage among the tested parameter subsets, while zeroing weight-magnitude-selected parameters causes smaller, differently structured damage.

C Zeroing Interventions on the SAFT Model

D Drift of the Robustness-Critical Parameters during Training

The calibrated robustness-critical parameter mask reorganizes once as training leaves the pretrained state, then remains stable. The final mask retains substantial overlap with calibration, while a smaller parameter budget incurs limited reported accuracy costs.

D Drift of the Robustness-Critical Parameters during Training

  • Table 14 reports relative drops after zeroing 5% of trained SAFT parameters, using 82.55% clean and 44.41% PGD-20 as the unmasked baseline.The caption does not provide the masked-model results.Source: Table 14 · p. 15
  • 57.58% of the final top-ρ set overlaps the calibration mask, versus roughly 5% expected for random subsets, and the set is stable after one reorganization.The comparison is reported for SAFT and a Full AT reference run.Source: D Drift of the Robustness-Critical… · pp. 14–15
  • Reducing the parameter budget from 5% to 1% costs 0.70 points on PGD-20 and 0.79 on AutoAttack.The authors interpret this as evidence that robustness is carried by a core smaller than the mask; they did not evaluate dynamic re-selection.Source: D Drift of the Robustness-Critical… · p. 15

E Distribution Shift

Across distribution shifts, SAFT has smaller relative degradation than LoRA on every benchmark and than Full AT on three of five, with the highest shifted PGD-20 accuracy throughout. The paper also frames reduced memory costs as lowering barriers to robust-model deployment in compute-limited settings.

E Distribution Shift

  • SAFT has smaller relative degradation than LoRA on every benchmark and than Full AT on three of five, and the highest PGD-20 accuracy under every shift.The evaluation covers synthetic and natural shifts.Source: E Distribution Shift · p. 15
  • The shift evaluation reports corruption mCA and relative degradation, natural-shift accuracy, and PGD-20 accuracy under both shift families.Corruptions use severity 5; the CINIC-10 evaluation uses a class-balanced 10,000-image subsample, so its no-attack accuracies differ slightly from Table 16.Source: E Distribution Shift · p. 15, Table 15 · p. 15, Table 16 · p. 15

F Broader Impact

  • SAFT is presented as reducing optimizer-state and gradient memory costs for robust adaptation on large pretrained models, lowering deployment barriers for compute-limited researchers and practitioners.The authors report no foreseeable negative societal impact beyond the general dual-use nature of adversarial robustness research.Source: F Broader Impact · p. 15

Related papers

Loading 2610.39455v1…