Boosting Adversarial Robustness with CLAT: Criticality Leveraged Adversarial Training
Authors: Bhavna Gopal
Huanrui Yang
Jingyang Zhang
Mark Horton
Yiran Chen
Venue: ICML 2025 poster (2025)
Keywords: Computer Vision
Adversarial robustness
Criticality
Computer vision
Adversarial attacks
Defense
Safety
Primary area: deep_learning->robustness
TL;DR: CLAT mitigates adversarial overfitting by selectively fine-tuning robustness-critical layers and achieves SOTA performance across all baselines, with over 2% improvements in both clean accuracy and adversarial robustness.

Abstract: Adversarial training (AT) enhances neural network robustness. Typically, AT updates all trainable parameters, but can lead to overfitting and increased errors on clean data. Research suggests that fine-tuning specific parameters may be more effective; however, methods for identifying these essential parameters and establishing effective optimization objectives remain inadequately addressed. We present CLAT, an innovative adversarial fine-tuning algorithm that mitigates adversarial overfitting by integrating "criticality" into the training process. Instead of tuning the entire model, CLAT identifies and fine-tunes fewer parameters in robustness-critical layers—those predominantly learning non-robust features—while keeping the rest of the model fixed. Additionally, CLAT employs a dynamic layer selection process that adapts to changes in layer criticality during training. Empirical results demonstrate that CLAT can be seamlessly integrated with existing adversarial training methods, enhancing clean accuracy and adversarial robustness by over 2% compared to baseline approaches.

Boosting Adversarial Robustness with CLAT: Criticaltyy-Levrraeed Adversarial Training
Bhavna Gopal'
Huanrui Yang²
Jingyang Zhang'
Mark Horton Yiran Chen
Abstract
the coexistence of robust and non-robust features in stan- dard datasets. Adversarial vulnerability largely stems from the presence of non-robust features in models trained on standard datasets, which, while highly predictive and bene- ficial for clean accuracy, are susceptible to noise (Szegedy et al., 2014). Unfortunately, is observed that deep learning models tend preferentially learn these non-robust fea- tures. Inkawhich et al. (2019; 2020) further demonstrate that adversarial images derived from the hidden features of certain intermediate non-robust/"critice enhanced transferability to unseen models. This suggests a commonality in the non-robust features captured by these layers. While identifying these critical layers improve their robustness is appealing, this process often requires the time-consuming generation of attacks against each individ- ual layer. Methods to identify and effectively address the criticality of such layers are still lacking.
Adversarial training (AT) enhances neural net- work robustness. Typically, AT updates all train- able parameters, but can lead to overfitting and increased errors on clean data. Research sug- gests that fine-tuning specific parameters may be more effective; however, methods for identifying these essential parameters and establishing effec- tive optimization objectives remain inadequately addressed. We present CLAT, an innovative adver- sarial fine-tuning algorithm that mitigates adver- sarial overfitting by integrating "criticality" into the training process. Instead of tuning the entire model, CLAT identifies and fine-tunes fewer pa- layers- those pre-
layers exhibit
rameters in robustness-critee dominantly learning non-robust features- while keeping the rest of the model fixed. Additionally, CLAT employs dynamic layer selection process that adapts to changes in layer criticality during training. Empirical results demonstrate that CLAT can be seamlessly integrated with existing adver- sarial training methods, enhancing clean accuracy and adversarial robustness by over 2% compared to baseline approaches.
In contrast to layer-wise feature vulnerability analysis, ad- versarial training (Athalye et al., 2018; Madry al., 2019; Croce & Hein, 2020), involves training entire neural net- works with adversarial examples generated in real-time, This approach inherently encourages all layers in the model to learn robust features from adversarial images, thereby enhancing the model's resilience against attacks. However, given the more challenging optimization process of learning from adversarial examples than from clean ones, adversarial training also brings hurdles such as heightened errors on clean data and susceptibility overfitting, ultimately dimin- ishing its effectiveness in practical applications (Schmidt et al., 2018; Zhang et al., 2019; Raghunathan et al., 2019; Javanmard et al., 2020). Despite various efforts to enhance adversarial training, such as modifying input data and ad- justing loss functions (Hitaj et al., 2021; I; Raghunathan et al., 2019; Zhang al., 2019; Wang et al., 2020; Wu al., 2020b; Pang et al., 2022), these approaches still frequently fall short in alleviating the aforementioned issues.
1. Introduction
Advancements in deep learning models have markedly im- proved image classification accuracy. Despite this, their vulnerability to adversarial attacks - subtle modifications to input images that mislead the model remains a sig- nificant concern (Goodfellow al., 2015; Szegedy al., 2014). The research community has been rigorously explor- ing theories to comprehend the mechanics behind adversar- ial attacks (Bai et al., 2021). Ilyas et al. (2019) uncover
'Department of Electrical and Computer Engineering, Duke University, Durham, NC, USA Department of Electrical and Com- puter Engincering. University Arizona, Tucson, AZ, USA. Cor- respondence to: Bhayna Gopal <bhavna.gopalee buke.edux>>
In light of these challenges, we introduce CLAT, a paradigm shift in adversarial training, where we mitigate overfitting during adversarial training by identifying and tuning only the robustness-critie model layers. CLAT commences by pinpointing critical layers within a model using our novel. theoretically grounded, and easily computable, "criticality
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Boosting Adversarial Robustness with CLAT: Criticaliy- Adversarial Training
index", which we developed to identify layers which have learned non-robust features dominantly. Subsequently, our algorithm meticulously fine-tunes these critical layers to remove their non-robust features and reduce their critical- ity, while freezing the other, non-critical layers. Dynamic selection of critical layers is conducted during the training process to always focus fine-tuning on the most-in-need layers, avoiding the overfitting of full-model adversarial training. CLAT therefore achieves both clean and adversar- ial state-of-the-art (SOTA) accuracy compared to previous adversarial training methods.
could fortify defenses. Their findings provide a foundation for our method which integrates these intermediate critical layers into our adversarial training strategy.
Adversarial training improvements and robust over- fitting: Adversarial training methods like PGD-AT and TRADES are computationally expensive and prone to over- fitting, requiring multi-step adversary generation, complex objectives, and extensive model tuning (Shafahi et al., 2019). To improve efficiency, Shafahi al. (2019) proposed "Free" AT, which accelerates training by using single backpropa- gation step for both training and PGD adversary generation. However, gradient alignment issues led to reduced robust- ness and increased overfitting. Similarly, Wong et al. (2020) introduced "Fast" AT, but also suffered from similar weak- nesses (Andriushchenko & Flammarion, 2020), prompting the development of GradAlign. Unfortunately, GradAlign tripled training time due to second-order gradient compu- tation. Later efforts sought to address robust overfitting. RiFT (Zhu et al., 2023) improved general performance by leveraging layer redundancies but was constrained by heuris- tic redundancy measurements. Xu et al. (2024) mitigated overfitting by disentangling natural and adversarial objec- tives, yet model-wide adjustments still limited robustness. In contrast, CLAT uses theoretically grounded, dynamic, critical layer selection mechanism, resulting in improved robust generalization by tuning a critical subset of layers. Furthermore, CLAT is agnostic to attack generation meth- ods in the AT processing, making it an ideal complement to existing fast-AT methods to mitigate overfitting.
In summary, we make the following contributions:
We introduce the "criticality index", quantitative met- ric designed to identify critical layers for the adversar- ial vulnerability of model with minimal overhead.
We develop a specialized adversarial training objective focused on reducing the criticality of the identified critical layers to bolster overall model robustness.
We propose CLAT, an adversarial fine-tuning algorithm that mitigates overfitting by focusing on reducing the criticality of fewer than 4% of trainable parameters. CLAT integrates seamlessly into diverse model training scenarios and baseline adversarial training methods.
CLAT markedly reduces overfitting risks, boosting both clean accuracy and adversarial resilience by up to 2%.
2. Related Work
3. Methods
Adversarial training: Adversarial Training (AT) was first introduced by Goodfellow al. (2015), who demonstrated how the integration of adversarial examples into the train- ing process could substantially improve model robustness. This idea evolved into a sophisticated minimax optimiza- tion approach with Projected Gradient Descent Adversarial Training (PGD-AT) (Madry et al., 2019), which employs PGD attacks in training. Regarded as the gold standard in AT, PGD-AT generates adversarial training samples using multiple steps of projected gradient descent, leading to sub- stantially improved empirical robustness (Carlini & Wagner, 2017; Athalye et al., 2018; Croce& & Hein, 2020). Further refining this approach, TRADES (Zhang et al., 2019) op- timizes a novel loss function to balance classification ac- curacy with adversarial robustness. Recent enhancements in AT, including model ensemble and data augmentation, have also produced notable improvements in model re- silience. (Xie et al., 2020; Yang et al., 2020; Carmon et al., 2022). Inkawhich et al. (2019) propose "Activation "ttacks" (AA) which underscore the efficacy of leveraging intermedi- ate model layers for generating stronger adversarial attacks, suggesting that incorporating AA in adversarial training
Building on prior attack and defense research (Inkawhich et al., 2019; 2020; Zhu et al., 2023) which demonstrates that not all model layers equally learn non-robust features and having all layers learn robust features leads to overfit- ting, we aim to improve model robustness by identifying and fine-tuning only those critical layers that are prone to learning non-robust features, while keeping the non-critical layers frozen. In this section, we begin by defining and identifying critical layers, then outline our objectives for reducing their criticality. Finally, we present our complete CLAT algorithm, which effectively mitigates overfitting.
3.1. Layer Criticality
Consider a deep learning model with n layers, and an input x. defined as:
F(x) = fn (n -())
(1)
where the functionality of the i-th layer is denoted as fr During the standard training process, all layers learn useful features which contribute to the correct outputs of the model.
2

---

Boosting Adversarial Robustness with CLAT: Leiveed Adversarial Training
We denote the hidden feature learned at the output of the i-th layer (x())) (-( (x)))
criticality will increase the weakness of the features after it, indicating the layer is critical according to Definition 3.1.
Under adversarial perturbation, features from all layers will be altered, leading to incorrect outputs. Following previous work (Hein& & Andriushchenko, 2017; Finlay et al., 2018), 8), the robustness, or weakness, of the feature can be linked to the local Lipschitz constant of function F.).). For a easier computation, we consider the worst-case feature difference under fixed input perturbation budget of c. This leads to our definition of the e-weakness of layer i's feature as:
One drawback of the formulation in Equation (3) is that computing the feature weakness involves finding the worst- case perturbation against the hidden features at each layer, which is a costly process to conduct sequentially for all layers. In practice, we approximate the worst-case perturba- tion against features with an untargeted PGD attack against the model output, so that turbation ò to estimate the feature weakness of all layers following Equation (2). In this way, with reasonably suf- ficient batch size, we can compute the critical indices for all layers in a model with two forward passes: one with the clean input x and one with the PGD attack input x + 6. We make the following proposition:
use the same PGD per-
1 N;
(F:)
E.
[F(( + 0) - (0lc++))FFFo Se
sup
(2)
where N₁ denotes the dimensionality of the output features at layer therefore normalizing the weakness measurement of layers with different output sizes. The weakness mea- surement is proportional to the local Lipschitz constant. A higher weakness value indicates that the feature vector is more vulnerable to input perturbations. The functionality of cascading layers from to i affects the vulnerability of the hidden features, as described by this formulation.
Proposition 3.2. Critical layers defined as in Definition 3.1 can be identified as the layers with the largest criticality.
To verify Proposition 3.2, we conduct an ablation study in Table 8, where we show that model robustness is im- proved more by CLAT fine-tuning of critical layers com- pared to equivalent fine-tuning of randomly selected layers. We will discuss how reduce the criticality of the eritical layers and make them more robust in the next subsection.
Alternatively, Moosavi-Dezfool et al. (2019) suggests the local curvature can be a more accurate estimation of ro- bustness. However, the computation and optimization of curvature involves costly higher-order gradient computa- tion. We provide additional derivations in Appendix F to show the feature weakness defined in Equation (2) is also an effective approximation to the local curvature value.
3.2. tritieed Fine-tuning
Once the critical layers are identified, we fine-tune them to reduce their criticality, thereby decreasing the weakness of subsequent hidden features and enhancing model robustness. For a critical layer i, we optimize the trainable parameters to minimize Cf.- Note that in the criticality formulation in Equation (3), the weakness of the previous layer's out- put, (1F-F constant with respect to ft. Thus, the optimization objective for fa can be simplified
For the purpose of mitigating overfitting, we want identify the layers that are the most critical to the lack of robustness, characterized by their increased susceptibility to adversarial perturbations. Other already-robust layers shall then be fixed to avoid further overfitting to the adversarial training objective. We therefore provide the following definition:
Cc(s)) = Er sup ||B + 5) - Fo(x))l2 ||
(4)
Definition 3.1. Critical layer: A layer is considered critical if it exhibits a greater propensity to learn non non-robust features or demonstrates diminished robustness adversarial input perturbations relative to other layers in the model.
In the case where multiple critical layers are considered in the fine-tuning process, the fine-tuning objective can be expanded to accommodate all critical layers simultaneously. Formally, suppose we have a set S where layers E S are all selected for fine-tuning, the fine-tuning objective for these critical layers can be formulated
To this end, we single out the contribution of each layer's functionality to the weakness of the features after with a Layer Criticality C,,, which is formulated
(FFFF)
C₁. = (c(FF-1)
(3)
Lc(fs) Er, sup [|18|| IES
- -F(o)l (5)
For the first layer, we define C₁2 (Fi) as only the first layer contributes to the weakness.
where single perturbation is utilized to capture the weak- ness across all critical layers. A projected gradient ascent with random start is used for the inner maximization.
As a sanity check, the feature weakness at the output of layer i can be attributed to the criticality of all previous layers as (FF)) = li Cta- Conversely, layer with a larger
Minimizing the objective in Equation (5) by adjusting the trainable variables of the critical layers will reduce their
3

---

Boosting Adversarial Robustness with CLAT: Criticality Adversarial Training
feature weaknesses. However, the removal of non-robust features in these layers may affect the functionality of the model on clean inputs. As a tradeoff, we also include the cross entropy loss (-) in the final optimization objective, which derives the optimization objective on the critical lay-
(Simonyan & Zisserman, 2015). In this paper, these archi- tectures are referred to WRN34-10, WRN70-16, RN50, RN18, DN121, Preact RN18 and VGG19 respectively.
Training and evaluation Since CLAT can be layered over clean pretraining, partial training, or other adversarial meth- ods, results incorporating CLAT are denoted in our tables as "X + CLAT," where "X" refers to the baseline method applicd prior to CLAT. Typically, this baseline method is run for the first 50 epochs, followed by fine-tuning during which CLAT is applied for an additional 50 epochs. The total number of epochs is in line with the 100 epochs used in previous PGD-based adversarial training work (Zhang et al., 2019; Zhu et al., 2023).
ers during the fine-tuning process
min H,nEE,, (g + Xfo(fs) 1s
(6)
where the hyperparameter À balances the two loss terms.
Note that only the selected critical layers fs are optimized in Equation (6) while the other non-critical layers are frozen, preventing them from further overfitting.
3.3. CLAT Adversarial Training
For our baseline, we use PGD for attack generation during training, following a random start (Madry et al., 2019), with an attack budget of 0.03 under the εx norm, a step size of 0.007, and 10 attack steps. The same settings apply to PGD attack evaluations. Auto/Attack evaluations (Croce & Hein, 2020) also use budget of e 0.03 under the exo norm, with no restarts for untargeted APGD-CE, 9 target classes for APGD-DLR, 3 target classes for Targeted FAB, and 5000 queries for Square Attack. These settings remain consistent unless explicitly noted otherwise.
We design CLAT as a fine-tuning approach, which is applied to neural networks that have undergone preliminary train- ing. The pretraining phase allows all layers in the model to capture useful features, which will facilitate the identi- fication of critical layers in the model. Notably, CLAT"s versatility allows it to adapt to various types of pretrained models, either adversarially trained or trained on a clean dataset only. In practice, we find that models do not need to fully converge during the pretraining phase to benefit from CLAT fine-tuning. For example, in case of the CIFAR-I0 dataset, 50 epochs of PGD-AT training would be adequate. We consider the number of adversarial pretraining epochs as a hyperparameter and provide further analysis on the impact of pretraining epochs in Section 4.2.
Experiments were conducted on Titan XP GPU, starting with an initial learning rate of 0.1, which was adjusted ac- cording to cosine decay schedule. To ensure the reliability of robustness measurements, we conducted each experiment a minimum of 10 times, reporting the lowest adversarial accuracies we observed.
After the pretraining. CLAT begins by identifying and se- lecting critical layers in the pretrained model. Please see Appendix A and Algorithm in Appendix C for more clarity. As fine-tuning progresses, the critical layers will be updated to reduce their criticality, making them less critical than some of the previously frozen layers. Subsequently, we perform periodic reevaluation of the top l critical in- dices, ensuring continuous adaptation and optimization of the layers that are the most in need in the training process. Through hyperparameter optimization, we find 10 epochs to be adequate to optimize the selected critical layers for all models that we tested.
CLAT settings We select critical layers as described in Section 3.1. Table 10 outlines the Top-5 most critical layers for some of the models and corresponding datasets at the start of the CLAT fine-tuning, after adversarially train- ing with PGD-AT for 50 epochs. In customizing the CLAT methodology to various network sizes, we select approx- imately 5% of layers as critical through hyperparameter optimization. For instance, DN121 uses 5 critical layers, while WRN70-16, RN50, WRN34-10. VGG19, and RN18 use 4, 3, 1, and I critical layers, respectively.
4. Experiments and Settings
4.1. CLAT Performance
Datasets and models We conducted experiments using CIFARIO and CIFAR100, typical choice for previous robust- ness research. Each dataset includes 60,000 color images, each 32x32 pixels, divided into 10 and 100 classes respec- tively (Krizhevsky & Hinton, 2009). For our experiments, we deployed a suite of network architectures: WideResnets (34-10, 70-16) (Zagoruyko& & Komodakis, 2017), ResNets (50, 18) (He et al., 2016b), DenseNet-122 121 (Huang et al., 2017), PreAct ResNet- 18(He et al., 2016 and VGG-19
White-box robustness Table 1, Table 2, and Table present white-box evaluation results using the PGD and Auto Attack frameworks across CIFAR and ImageNet. These tables illustrate CLAT's versatility and effectiveness when combined with various standard adversarial training methods, including statc-of-the-art benchmarks from Ro- bustBench (Croce et al., 2020), and when applied to larger datasets such as ImageNet (see Table 2). CLAT consistently mitigates the overfitting observed in traditional adversar-
4

---

Boosting Adversarial Robustness with CLAT: Criticalit--Leveraeee Adversarial Training
Table 1. Adversarial accuracy CIFAR-10 and CIFAR- 100 when subjected PGD-20 attack.
NETWORK
METHOD
CIFAR-I0 (%)
CIFAR-100 (%)
CLEAN
ADV.
CLEAN
ADV.
DN121
PGD-AT AT (MADRY ET Al.., 2019)
80.05
58.15
57.18
31.76
PGD-AT CLAT
81.03
60.60
58.79
33.23
WRN70-16
PGD-AT (PENG ET AL., 2023)
93.27
71.07
70.20
42.61
PGD-AT CLAT
93.56
72.25
71.94
44.12
BALET AL. (BAT ET Al.,, 2024)
92.23
64.55
69.17
40.86
BAT ET AI. + CLAT
92.77
64.92
70.17
41.64
RN50
PGD-AT
81.38
56.35
58.16
33.01
PGD-AT CLAT
83.78
59.54
61.88
36.23
WRN34-10
PGD-AT
87.41
55.40
59.19
31.66
PGD-AT + LORA (ALEEM ET AL.. 2024)
73.36
56.17
55.56
31.43
PGD-AT + RIFT (ZHU ET AL., 2023)
87.89
55.41
62.35
31.64
PGD-AT CLAT
88.97
57.11
62.38
32.05
TRADES (ZITANG ET AL., 2019)
87.60
56.61
60.56
31.85
TRADES RIFT
87.55
56.72
61.01
32.03
TRADES CLAT
88.23
57.89
61.45
33.56
VGG19
PGD-AT
78.38
50.35
50.16
26.54
PGD-AT CLAT
79.88
$2.54
50.98
28.41
RNI8
PGD-AT
81.46
53.63
57.10
30.15
PGD-AT LORA
76.57
55.38
48.49
32.36
PGD-AT RIFT
83.44
53.65
58.74
30.17
PGD-AT CLAT
83.89
55.37
59.22
32.04
TRADES
81.54
53.31
57.44
30.20
TRADES RIFT
81.87
53.30
$7.78
30.22
TRADES CLAT
81.89
54.57
58.82
31.06
PREACT RN18 FAST-AT (WONG ET AL., 2020)
81.46
45.55
50.10
27.72
FAST-AT CLAT
84.46
52.13
54.33
29.22
FAST-AT CLAT (FAST)
82.72
49.62
52.10
27.99
ial training, enhancing both clean and adversarial accuracy compared to baseline methods.
more attack strengths and datasets in Appendix D.
Table further highlights that reducing trainable parameters alone does not necessarily lead to improved performance. CLAT surpasses LoRA (Aleem et al., 2024) and RiFT (Zhu al., 2023) thanks its ability precisely identify critical layers and eliminate non-robust features from these layers. We also show that fast adversarial training techniques, dis- cussed by Wong et al. (2020), can be applied to address the inner maximization problem in the CLAT training objective described in Equation (5). The "CLAT (Fast)" method not only enhances performance but also improves robustness compared to Fast-AT baselines.
Table 2, Clean and Adversarial Accuracies (PGD-20) performance comparison ImageNet.
MODEL
METHOD
CLEAN AcC.
ADV. AcC.
DN121
PGD-AT
63.25
32.56
PGD-AT CLAT
66.10
35.48
RN50
PGD-AT
65.88
33.18 18
PGD-AT CLAT
67.12
36.91
WRN34-10
PGD-AT
64.31
31.08
PGD-AT CLAT
66.12
33.59
Notably, CLAT models are trained with PGD-like attacks on hidden features without seeing Auto Attacks directly, but their robustness persists under these attacks (see Ta- ble 3). This suggests that different attacks across various networks share similarities in exploiting non-robust features. By addressing these non-robust features through critical layer fine-tuning, CLAT's robustness is adaptable across different attack settings and models. Similarly, CLAT also helps preserve higher clean accuracy, benefiting from the reduced overfitting. Lastly, we evaluate robustness across
Black-box robustness Table 4 and Table 5 evaluate the robustness against black-box attacks (Auto Attack and PGD- AT respectively) between models trained solely using PGD- AT and those augmented with CLAT. Attack settings the same those of the white-box attacks. As sanity check, the accuracies under black-box attack surpass those observed under white-box scenarios, indicating that gradient masking does not appear the CLAT model, and that the white-box robustness evaluation is valid. More significantly, models trained with CLAT consistently outperform those
5

---

Boosting Adversarial Robustness with CLAT: Criticality-Leveragee Adversarial Training
Table 3. Adversarial accuracy CIFAR-10 and CIFAR-100 when subjected to AutoAttack (AA).
NETWORK
METHOD
CIFAR-10 (%)
CIFAR-I00 (%)
CLEAN
ADV.
CLEAN
ADV.
DN121
PGD-AT
80.05
47.56
57.18
23.13
PGD-AT CLAT
81.03
49.91
58.79
25.74
WRN70-16
PGD-AT
93.27
54.32
70,20
28.25
PGD-AT + CLAT
93.56
57.64
71.94
30.98
(CaRLinI & WAGNER, 2017)
66.10
(CARLINI WAGNER, 2017) + CLAT
68.43
RN50
PGD-AT
81.38
46.22
58.16
23.48
PGD-AT + CLAT
83.78
49.45
61.88
25.81
WRN34-10
PGD-AT
87.41
51.50
59.19
25.56
PGD-AT CLAT
88.97
52.88
62.38
27.62
VGG19
PGD-AT
78.38
40.42 42
50.16
19.54
PGD-AT + CLAT
79.88
41.72
50.98
20.45
RNI8
PGD-AT
81.46
40.48
57.10
20.21
PGD-AT + CLAT
83.89
42.86
59.22
21.76
TWINS (LIU ET AL., 2023)
76.57
47.89
48.49
25.45
TWINS CLAT
83.44
51.39
58.74
28.12
AUTOLORA (XU AL.. 2024)
84.20
48.95
62.10
27.48
AUTOLORA CLAT
86.45
53.21
64.91
30.49
trained with PGD-AT, maintaining superior resilience in both black-box and white-box settings, regardless of the attack method or models employed.
cality can be linked to the curvature of the local minima to which each layer converges during adversarial training.
Ablating on critical layer selection The choice of critical layer selection is another important feature impacting the performance of CLAT. We begin by examining the effect of dynamic layer selection. Table and Table 7 highlight that dynamic selection is crucial to CLAT's performance. Using the same layers throughout the process tends cause overfitting and results in lower accuracies compared the PGD-AT bascline.
4.2. Ablation Studies
Ablating pretraining epochs before CLAT As dis- cussed in Section 3.3, apply CLAT after the model has been adversarially trained for some epochs. Here, we ana- lyze how the number of pretraining epochs affects CLAT performance. Figure shows the training curves for dif- ferent allocations of PGD pretraining epochs and CLAT fine-tuning epochs within 100-epoch training budget. The overfitting of PGD-AT is evident adversarial accuracy plateaus and declines towards the end, as documented in previous research (Rice et al., 2020). In contrast, CLAT continues to improve adversarial accuracy, effectively ad- dressing this issue. Including CLAT at any stage of training results in higher clean accuracy and robustness at conver- gence. Additional results on pretrained clean models are provided in Appendix
To verify the significance of the selected critical layers, we compare CLAT with an alternative approach in which ran- dom layers are dynamically selected for fine-tuning instead of the critical layers. The results of this comparison are detailed in Table 8.
The data demonstrates that selecting critical layers signif- icantly enhances the model's adversarial robustness and clean accuracy. This observation is bolstered by our ab- lation study in Appendix E (Table 19), illustrating the performance effect of choosing the smallest versus largest critical indices for fine-tuning. Furthermore, Table indi- cates near-identical critical layer selections within the same model, even across diverse datasets. This evidence supports our assertion that the variation in layer criticality arises from inherent properties within the model architecture, where cer- tain layers are predisposed to learning non-robust features.
Furthermore, intriguing aspect of experiments in- volves running CLAT from scratch (0 PGD-AT epochs). Although CLAT ultimately surpasses PGD-AT with suffi- cient epochs, using CLAT without any prior adversarial training results in significantly slower model convergence. We believe this suggests that "layer criticality" emerges dur- ing the adversarial training process, allowing critical layers to be identified as the model undergoes adversarial training. This phenomenon supports our theoretical insight that criti-
Lastly, we conduct an ablation study on the number of lay- ers used in CLAT for fine-tuning. Figure and Figure
6

---

Boosting Adversarial Robustness with CLAT: Criticalit--Leveraeee Adversarial Training
Table Comparative Black-box Auto attack accuracy on CIFAR-10 and CIFAR-100, with rows attackers and columns victims.
NETWORK METHOD
CIFAR-IO (%)
CIFAR-100 (%)
DN121
RN50
VGG19
RNI8
DN121
RN50
VGG19
RN18
DN121
PGD-AT
52.50
44.21
45.45
27.64
23.21
24.26
PGD-AT + CLAT
55.83
47.53
48.92
29.89
26.71
26.93
RN50
PGD-AT
54.23
43,56
43.24
27.91
23.02
23.51
PGD-AT + CLAT
56.72
46.21
47.01
30.11
26.34
25.86
VGG19
PGD-AT
55.32
55.45
46.72
27.84
28.15
24.20
PGD-AT CLAT
59.83
59.72
49.31
30.20
29.79
26.55
RNI8
PGD-AT
53.21 56.75
51.73
43,21
29.31
26.75
22.91
PGD-AT CLAT
54.45
46.53
31.25
29.41
25.95
Table Comparative Black- PGD accuracy on CIFAR-10
CIFAR-106 with rows as attackers and columns as victims.
NETWORK METHOD
CIFAR-10 (%)
CIFAR-100 (%)
RN50
DN121
VGG19
RN18
RN50
DN121
VGG19
RN18
RN50
PGD-AT
74.83
68.01
67.44
46.82
40.55
40.10
PGD-AT CLAT
76.45
71.25
70.12
48.49
44.34
43.91
DN121
PGD-AT
72.24
69.53
68.38
44.45
40.63
41.22
PGD-AT+
74.55
71.78
70.56
46.78
43.62
42.88
VGG19
PGD-AT
65.72
67.56
62.26
47.86
46.56
40.55
KGD-AT+ CLAT
66.46
70.72
65.78
49.25
48.72
42.72
RN18
PGD-AT
74.82
70.21
61.83
46.28
45.59
39.21
PGD-AT CLAT
76.23
73.19
63.96
48.89
47.72
41.78
Table 6. PGD-10 Adversarial accuracy of PGD-AT, PGD-AT
Table 7. Auto Attack Adversarial accuracy of PGD-AT, PGD-AT CLAT, and its Non-dynamic variant.
CLAT, and its Non-dynamic variant.
METHOD
CIFAR- 10 (%)
CIFAR 100 (%)
METHOD
CIFAR 10 (%)
CIFAR 100 (%
DN121
RN50
DN121
RN50
DN121
RN50
DN121
RN50
PGD-AT PGD-AT + CLAT
58.15
56.35
31.76
33.01
PGD-AT
47.56
46.22
23.13
23.48
60.60
59.54
33.23
36.23
PGD-AT CLAT
49.91
49.45
25.74
25.81
CLAT (ND)
57.01
54.22
30.34
32.98
CLAT (ND)
47.12
46.08
22.26
22.91
illustrate the trade-offs between adversarial accuracy and the number of layers selected, well as clean accuracy and the number of layers, respectively. Interestingly, both adversarial and clean accuracy are optimized with the same number of layers. Initially, fine-tuning more layers enhances model performance by increasing flexibility; however, this eventually diminishes CLAT's effectiveness, likely because attention is diverted to less crucial layers the expense of more important ones. This pattern underscores the critical role of specific layers in network robustness and empha- sizes the need for deeper research into the dynamics of individual layers. Furthermore, we highlight that although the number of layers chosen impacts the learned robustness, CLAT still achieves robustness gains over the carly-stopping baseline (no fine-tuning) with up to 10% of the layers se-
lected, demonstrating its stability under small variations in the number of selected layers.
Overhead and stability analysis CLAT only updates
small subset of model undd 5% across all architectures (see Table 9) h)-hhiglggg the effectiveness of selective fine-tuning over full-model retraining. When considering optimization cost, the CLAT objective remains comparable standard adversarial training, as it shares the same min-max formulation (see Equation (6)). CLAT's layer selection process is also highly stable: as shown in Table 11, criticality indices can be reliably estimated using a single batch of just 10 training examples, with top-ranked layers nearly identical to those obtained using much larger batches. To quantify this consistency, we ran over 1000

---

Boosting Adversarial Robustness with CLAT: Criticality-eeveraeee Adversarial Training
CLAAT Starting Point vs, Clean Accuracy
CLAT Startnng Point vs, Adversarial Accurncy
Clean SACHFERC (%)
69
50
CI-TT spochs
CIAT epocks
epoelts PGD
T0 PGD AT
spotoo (peet
spechs (pest
spects)
spadteccpppe (peat PGB-XT spedio
opechs (peat
specis)
spacii (pent PGD-AT for spacko)
10 opechs (pea PGD-AT for 90 opecis)
epodt (PGD-AT for 100 specks)
opecha (PGD-AT for cpacka)
cpochs
Total epochs
Figure 1. CLAT on WRN34- 10: CIFAR-10 10 comparative performance across partially trained models.
Table Ablation of CLAT layer choices datasets and models. Each model is trained using either critical random layers. Columns report clean accuracy and adversarial accuracy under PGD-10 10 and AutoAttack (AA).
MODEL
DATASET
LAYER SELECTION CLEAN Acc.
PGD-10
AA
DN121
CIFAR-10
CRITICAL
81.03
60.60
49.91
RANDOM
78.85
51.35
39.81
CIFAR-100
CRITICAL
58.79
33.23
25.74
RANDOM
50.45
25.48
20.21
RN50
CIFAR-10
CRITICAL
83.78
59.54
49.45
RANDOM
79.01
51.44
40.29
CIFAR-100
CRITICAL
61.88
36.23
25.81
RANDOM
52.20
25.51
20.45
RNI8
CIFAR-10
CRITICAL
83.89
55.37
42.86
RANDOM
78.02
51.03
33.50
CIFAR-100
CRITICAL
50.98
28.41
20.45
RANDOM
43.15
20.24
15.89
Table 9. Trainable parameters during CLAT
Table 10. Top-S critical layers by model and dataset; CLAT layers bolded.
NETWORK
TRAINABLE PARAMS % USED
Model
CIFAR-10
CIFAR-100
TOTAL
CLAT
DN121
39, 14, 1, 3, 88
39, 1,
DN121
6.96M
217K
3.1%
WRN70-16
4, 17, 19, 62
3, 27,
WRN70-16
267M
8.29M
3.0%
RN50
34, 3,
34, 44,43,4,666 6,
RN50
23.7M
823K
3.4%
WRN34-10
3,,
3,
WRN34-10
46.16M
1.24M
2.7%
VGG19
9,11,
8, 13, 5,
RNI8
11.2M
590K
5.2%
VGG19
39.3M
236K
0.6%
RN18
10,
12, 2,
5. Conclusions
trials per model with different random batches and observed that the top five selected layers varied in fewer than 5% of cases- -typicllyyy involving only single-layer swap. This stability allows CLAT to recompute critical layers using only 0.0002% % of training data every 10 epochs, incurring a negligible 0.4 time overhead compared to standard adver- sarial training.
This work introduces CLAT, an innovative adversarial train- ing approach that addresses robust overfitting issues by fine-tuning only the critical layers vulnerable to adversar- ial perturbations. This method not only emphasizes layer- specific interventions for enhanced network robustness but also sheds light on the commonality non-robust features captured by these layers, offering targeted and effective
8

---

Boosting Adversarial Robustness with CLAT: Criticalit--Levrragee Adversarial Training
CIFAR-10
Impact Statement
60.0
RN50
DN-121
There are many potential societal consequences of our work, particularly as adversarial robustness becomes critical for the safe deployment of machine learning systems. Robust models help prevent harmful failures in high-stakes settings such as healthcare autonomous navigation. How- ever, stronger defenses may also incentivize more adaptive and sophisticated attacks. We encourage further study on how robustness techniques generalize over time and interact with evolving threat landscapes.
Adv Acc
57.5
55.0
52.5
50.0
CIFAR-100
35
RN50
DN-121
Adv Acc
30-
25
9
15
20
No. critical layors
Figure 2. CLAT accuracy number of critical layers used.
Table DenseNet-122 121 critical layers identified with different amounts of data. Time taken compute critical layers evaluated on a TITAN RTX GPU. PGD-AT epoch takes 67s.
BATCH SIZE
CRITICAL LAYERS
TIME (S)
CIFAR-10
10
39,
14.
1, 3, 90
2.64
30
39,
88
2.72
50
39,
14.
1, 3, 89
2.83
100
39,
14.
1, 3,
88
3.15
CIFAR 100
39,
15,
1, 2,
91
2.82
30
39.
15,
1.
2,
88
2.91
50
39,
15,
1,
91
3.14
100
39,
15.
2.
3.54
defense strategy. This targeted intervention enhances net- work robustness while highlighting the shared non-robust features captured by these layers. CLAT selects less than 5% of trainable variables yet significantly improves clean accuracy and adversarial robustness across diverse archi- tectures and adversarial training methods. While this work focuses on empirical robustness, open questions remain on why certain layers are critical, how to refine their identifica- tion, and whether architectural or training modifications can address these issues. We leave these theoretical directions for future work.
Acknowledgements
This work was made possible through the support of NSF 21 112522 and ARO W91 2-222-22222.

---

Boosting Adversarial Robustness with CLAT: Criticality-Levrragee Adversarial Training
References
Hitaj, D., Pagnotta, G., Masi, I., and Mancini, L. V.
Evaluating the robustness of geometry-aware instance- reweighted adversarial training, 2021.
Aleem, S., Dietlmeier, J., Arazo, E., and Little, S. Con- vlora and adabn based domain adaptation via self-training. arXiv preprint arXiv:2402.04964 2024.
Huang, G., Liu, Z.,, Van Der Maaten, L.,, and Weinberger, K. Q. Densely connected convolutional networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 4700-4708, 2017.
Andriushchenko, M. and Flammarion, Understanding and improving fast adversarial training, 2020.
Athalye, A., Carlini, N., and Wagner, D. Obfuscated gra- dients give false sense of security: Circumventing de- fenses to adversarial examples, 2018.
Hwang, J.-W., Lee, Y., Oh, S., and Bac, Y. Adversarial training with stochastic weight average, 2020. URL www.aawwwww...aaao.eeeooeeeereee alggg/bs/2090... 10526.
Bai, T., Luo, J., Zhao, J., Wen, B., and Wang, Q. Recent advances in adversarial training for adversarial robustness, 2021.
Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019.
Bai, Y., Anderson, B. G., Kim, A., and Sojoudi, S. Improv- ing the rccuracy-robustness trade-off of classifiers via adaptive smoothing, 2024.
Inkawhich, N., Wen, W., Li, H. H., and Chen, Y. Feature space perturbations yield more transferable adversarial examples. Proceedings of the IEEE/CVE Conference on Computer Vision and Puttern Recognition (CVPR), June 2019.
Carlini, N. and Wagner, D. Towards evaluating the robust- ness of neural networks, 2017.
Carmon, Y., Raghunathan, A., Schmidt, L., Liang, P., and Duchi, J. C. Unlabeled data improves adversarial robust- ness, 2022.
Inkawhich, N., Liang, K., Wang, B., Inkawhich, M., Carin, I.., and Chen, Y. Perturbing across the feature hierarchy to improve standard and strict blackbox attack transferabil- ity. Advances in Neural Information Processing Systems, 33:20791 2020.
Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks, 2020.
Javanmard, A., Soltanolkotabi, M., and Hassani, H. Pre- cise tradeoff's in adversarial training for linear regression, 2020.
Croce, F., Andriushchenko, M., Schwag, V., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: standardized adversarial robustness benchmark. CoRR, abs/2010.09670,, 2020. URL abs/2010. 09670.
Krizhevsky, A. and Hinton, G. Learning multiple layers of features from tiny images. 2009.
Li, L. and Spratling, M. Data augmentation alone can improve adversarial training, 2023. URL https:// a arxiv. wttp://///bbb///////e// 09879.
Finlay, C., Calder, J., Abbasi, B., and Oberman, A. Lips- chitz regularized deep neural networks generalize and are adversarially robust. arXiv preprint arXiv: 1808 0954009 2018.
Liu, Z., Xu, Y., Ji, X., and Chan, A. B. Twins: A fine-tuning framework for improved transferability of adversarial robustness and generalization, 2023. URL https:// arxiv. www.eorg//abao. att.ab/////31111.
Goodfellow, J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples, 2015.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks, 2019.
He, K., Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks, 2016a.
He, K., Zhang, X., Ren, S., and Sun, Deep residual learn- ing for image recognition. In Proceedings of the IEEE conference computer vision and paltern recognition, pp. 770-778, 2016b.
Moosavi-Dezfooli, S.-M., Fawzi, A., Uesato, J., and Frossard, P. Robustness via curvature regularization, and vice versa. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9078- 9086, 2019.
Hein, M. and Andriushchenko, M. Formal guarantees on the robustness of a classifier against adversarial manipulation. Advances in neural information processing systems, 30, 2017.
Pang, T., Lin, M., Yang, X., Zhu, J., and Yan, S. Robustness and accuracy could be reconcilable by (proper) definition, 2022.
10

---

Boosting Adversarial Robustness with CLAT: Criticalit--eeveraeee Adversarial Training
Peng, S., Xu, W., Cornelius, C.,, Hull, M., Li, K., Duggal, R., Phute, M., Martin, J., and Chau, D. H. Robust principles: Architectural design principles for adversarially robust cnns, 2023.
Yang, H., Zhang, J., Dong, H., Inkawhich, N., Gardner, A., Touchet, A., Wilkes, W., Berry, H., and Li, H. Dverge: di- versifying vulnerabilities for enhanced robust generation of ensembles. Advances in Neural Information Process- ing Systems, 33:5505-5515, 2020.
Raghunathan, A., Xie, M., Yang, F., Duchi, J. C., and Liang, P. Adversarial training hurt generalization. arXiv preprint arXiv: 06032, 2019.
Zagoruyko, S. and Komodakis, N. Wide residual networks, 2017.
Rice, L., Wong, E., and Kolter, J. Overfitting in adversar- ially robust deep learning. 2020.
Zhang. H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E., and Jordan, M. Theoretically principled trade-off between robustness and accuracy. 2019.
Schmidt, I.., Santurkar, S., Tsipras, D., Talwar, K., and Madry, Adversarially robust generalization requires more data, 2018.
Zhu, K., Wang. J., Hu, X., Xie, X., and Yang, G. Improving generalization of adversarial training robust critical fine-tuning, 2023.
Shafahi, A., Najibi, M., Ghiasi A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T. Adversarial training for free!, 2019.
Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In 3rd Inter- national Conference on Learning Representations, ICLR 2015 Conference Track Proceedings, 2015.
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, Intriguing properties of neural networks, 2014.
Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Improving adversarial robustness requires revisit- ing misclassified examples. In International Confer- on Learning Representations, 2020. URL https: //openreview net/ forum? 1d=rklllr66l00
Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., and Yan, S. Better diffusion models further improve adversarial training, 2023. URL https: /awxxv.vvvvv.///////aa///aaa org/ /bs/ 2302.045 04638.
Wong, E., Rice, L., and Kolter, Z. Fast better than free: Revisiting adversarial training, 2020.
Wu, D., tao Xia, S., and Wang. Y. Adversarial weight perturbation helps robust generalization, 2020a. URL https:// /atpiv///rivvve//a org/ abs 2004.00000 05884.
Wu, D., tao Xia, S., and Wang, Y. Adversarial weight perturbation helps robust generalization, 2020b.
Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A., and Le, Q. V. Adversarial examples improve image recognition, 2020.
Xu, X., Zhang, J., and Kankanhalli, M. Autolora: An automated robust fine-tuning framework. In The Twelfth International Conference on Learning Representations, 2024. URL https:/ htttt:://ppneeeeeeeeeee /ttp///pppeeeeeee///e//e/ee htt.iiewweeeeeeeeeeeeeeeeeeeeeee net/ forum? i 1x009xFexxx jhQF

---

Boosting Adversarial Robustness with CLAT: Criticality-Leveragee Adversarial Training
Appendix
A. Method Diagram
Frozen non-critical layers
Clean
input
Adversarial input
Critical layers finetuning with criticality-aware loss
Continue training with new critical layers
Recompute critical
layers every 10 epochs
Clean
input
Adversarial
input
Recomputed critical
layers
Figure 3. CLAT overview. CLAT fine-tunes the selected critical layers (red) while freezing other layers (grey). fine-tuning objective is computed per Equation (6). Critical layers are adjusted periodically. Pseudocode provided Appendix C.
B. Hyperparameter Selection
Our fine-tuning algorithm is primarily governed by three hyperparameters:
Percentage of Critical Layers For each network, we conducted experiments selecting 2, up to all layers as critical (full fine-tuning). As noted in the main paper, allowing more layers to be fine-tuned enhances model flexibility, initially improving CLAT performance. However, fine-tuning more layers diminishes CLAT's effectiveness, likely due to the diversion of attention toward less-critical layers the expense more critical ones. Based on this, we 5% general threshold balance performance across architectures. Figure and Figure both support this selection.
Number of Fine-Tuning Epochs Based on Figure 1, fine-tuning for 30 epochs provides optimal performance, This trend persists when extending fine-tuning to 150 epochs, where the learning rate decays to zero, across all tested networks.
Frequency Computing Critical Indices We determine critical indices every 10 epochs, based on variance analysis conducted every training epoch. We found that critical layers typically require about 10 epochs reduce their criticality through CLAT, making this interval effective for recomputation.
C. Pseudocode of CLAT
To better facilitate an understanding of the CLAT process, we illustrate the pseudocode of the dynamic critical layer identification process and the criticality-targeeed fine-tume tne-tuning process in Algorithm Only the selected critical layers are being fine-tuned while all the other layers are frozen.
12

---

Boosting Adversarial Robustness with CLAT: Criticality-Leveraeee Adversarial Training
Algorithm I CLAT Algorithm
1: Input: Dataset D, pre-trained model F, batch size bs, total epochs N.
2: for epoch to N do
3: if eppcch110 = 1 then
4:
Find critical layers 5: 2 < Batch of training data in D
6: x 1+5 + <
PGD attack against 7: Compute W. (FF) for all layers with Equation (2)
8: Compute C₁, for all layers with Equation (3)
9:
Critical layers (C,)((,,)
10: end if
11: # fine-ture critical layers
12:
manibatches + CreatteMimibatches/ bs)
13:
for I, y in minibatches do
14:
Perturbation 8 + Equation (5) inner maximization Lc(ss) - Equation (5)
Weight update w[S] with Equation (6)
end for 18: end for
D. Additional Experiment Results
D.1. CLAT Generalization over Attack Strengths
We further compare the CLAT model robustness with the robustness of the PGD-AT model against white-box attacks of various strengths. As illustrated Figure 4, though both models are only trained against an attack of one strength 0.03), the improved robustness of CLAT is consistent across the full spectrum of attack strengths. This shows that CLAT overfitting to the specific attack strength used in training.
DN-121
RN-50
WRN-34-10
RN-18
VGG-19
Vilbod
Mobal
Meleed
Mohel CLAI
Mehee CLAT
Adverunt Acc.
CLAT
PGB
CLAT
CLAT
Adveroriall Acc. (%
Adh canariaa Acc.
Mnverprrial Apc.
8.5
3.14
8.5
4.34
Epsilon
Epsilon
Epsilon
Epsiloa
Epilion
Figure 4. White-box adversarial accuracy (y-axis) CIFAR-10 for models trained with CLAT (red) and pgd-at (blue). against PGD attacks varying strengths (X-axis)
D.2. Full Training Curves
Figure presents the full WRN34-10 training curves for both clean and adversarial accuracy on CIFAR-10. Overfitting remains the primary challenge, leads to the degradation of both clean and adversarial accuracy. This occurs when the model becomes overly tailored adversarial examples, diminishing its generalization ability and impacting robustness over time. To further illustrate this, we extend the learning curve experiments from Figure 1 to 150 adversarial training epochs, using a cosine learning rate scheduler that decays zero by epoch 150. As shown in Figure 5, PGD-AT models exhibit steady decline in performance with additional adversarial training, highlighting the effects of overfitting, In contrast, CLAT maintains stable performance and robustness throughout training. Notably, CLAT models achieve higher peak and final accuracies, exhibiting significantly less overfitting. Additionally, the orange line in Fig. represents CLAT trained from scratch without prior adversarial training.
13

---

Boosting Adversarial Robustness with CLAT: Levvead Adversarial Training
Full Training Curve Clean Accuracy
Full Training Curve Adv. Accuracy
c3Alt linm <LAt berwards
Adt.hraaraa (76)
Accorsa (ha)
AnWA
100
139
18
131
Specto
Specks
Figure 5. White-box PGD-10 adversarial accuracy (y-axis) CIFAR-IO for WRN34- 10 models trained with CLAT fine-tuning starting Epoch 70 (blue), CLAT from scratch (orange), and PGD-AT (green). The learning rate decays to 0 by Epoch 150..
D.3. Reduced Learning Rate Performance
We ensure fair comparison by reporting early stop performance at Epoch 100 in all main tables, recognizing that early stopping is effective in standard adversarial training and represents its best achievable performance. To further clarify the reporting of best and final accuracies, we present Figure 6, where we adjust the learning rate at Epoch 70-reducing it by a factor of 10-to to demonstrate that our results are not merely a consequence of early stopping.
Figure compares CLAT with original learning rate, CLAT with a reduced learning rate, and PGD-AT with reduced learning rate, all trained for 150 epochs with eventual decay of the learning rate zero. Across both clean and adversarial accuracies, CLAT consistently outperforms all configurations, demonstrating its effectiveness beyond the benefits of learning rate reduction. Additionally, standard PGD-AT (purple line) plateaus around Epochs 80-100 before declining significantly, whereas CLAT continues improving with additional fine-tuning, achieving higher final accuracy by mitigating robust overfitting.
While lowering the learning rate may yield short-term improvements, does not prevent further overfitting. contrast, CLAT enables continuous performance gains throughout training, independent of learning rate adjustments.
Clean Performance
Adversarial Performance
20DME Lanan $33.3 N0E-0 Saaded Dvve
xowvi Lawa
xopat Sunded Doas LK
Lone
Love
m
Alterattll Accemss (52)
Acamncy (1))
A/
170
1.0
122
Spochs
Rpecks
Figure 6. White-box accuracies (y-axis) WRN34-10 CIFAR-10 for models trained with the original Icarning rate multiplied by 0.1 at Epoch 70, using CLAT (green) and PGD-AT (red), compared to normal PGD-AT learning rate (purple).
14

---

Boosting Adversarial Robustness with CLAT: Leiveeadity-Lvveraeeed Adversarial Training
D.4. Performance on Other Datasets
This section presents results for Imagenette and ImageNet, using the same CIFAR training setup-sslecting 5% of layers as critical and a random batch of 50 data points for eriticality measurements. Our improvements align with CIFAR experiments, reinforeing that criticality appears to be architecture-speciie
D.4.1. IMAGENETTE
Results in Table 12.
Table 12. Comparative performance of CLAT across various net- works on Imagenette. Robustness is evaluated with white-box PGD- 10 and Auto Attack.
MODEL
METHOО
CLEAN Acc.
PGD-10
AA
DNI21
PGD-AT PGD-AT + CLAT
83.40
61.78
51.23
86.91
65.45
54.82
WRN70-16
PGD-AT
90.20 93.52
67.96
58.91
PGD-AT + CLAT
72.39
61.43
RN50
PGD-AT PGD-AT CLAT
84.02
62.10
50.45
87.11
64.89
54.31
WRN34-10
PGD-AT PGD-AT + CLAT
90.45
65,45
56.31
93.21
69.82
60.04
VGG19
PGD-AT
85.45
56.71
46.53
PGD-AT + CLAT
89.72
59.45
51.22
RN18
PGD-AT
83.01
60.04
PGD-AT + CLAT
86.42
62.91
51.23
D.5. Robustness against Other Attacks
We report the performance on varying strengths of 10 in Appendix D Figure 4. Table 13 highlights the robustness against stronger white-box attacks, including those not limited to &oo bbundded constraints.
Table 13. Adversarial accuracy attacks CIFAR-I0. 10. Blue values indicate the improvement achieved with CLAT.
ATTACK
МETHOD
DN121 (%)
WRN34-10 (%)
FAB
PGD-AT
44.80
40.12 12
PGD-AT + CLAT
+3.70
+5.03
STADV
PGD-AT
48.50
45,15
PGD-AT CLAT
+0.91
+1.89
PIXLE
PGD-AT
10.40
9.50
PGD-AT CLAT
+2.21
+1.90
PGD-6, (c 0.03)
PGD-AT
61.79
60.25
PGD-AT CLAT
+1.92
+1.45
PGD-6x (e 0.03, STEPS)
PGD-AT
57.01
54.01
PGD-AT CLAT
+1.92
+2.03
PGD-foc (e 0.03, 100 STEPS)
PGD-AT
56.89
53.12
PGD-AT CLAT
+1.63
+1.89
D.6. Additional Performance Comparisons to Baselines
We consider CLAT complementary to existing overfitting reduction techniques applied in full model optimization. Table 14 shows results when CLAT is augmented with SWA (Hwang et al., 2020) and AWP (Wu et al., 2020a) techniques. CLAT consistently enhances performance across all cases, demonstrating effectiveness alongside other approaches. We note
15

---

Boosting Adversarial Robustness with CLAT: Levveae Adversarial Training
that omitted values reported in the original work.
Additionally, Table 15 shows augmentation techniques applied in conjunction with CLAT. While augmentations effectively mitigate adversarial training, they focus on data, whereas our work optimizes the model and objective. Nonetheless, we showcase CLAT's performance when used with augmentations, further improving robustness over baseline methods.
D.6.1. STOCHASTIC WEIGHT AVERAGING AND ADVERSARIAL WEIGHT PERTCRBATION
Please see Table
Table 14. PGD-10 adversarial accuracy on CIFAR-I0 and CIFAR-100 for PreAct RN-18 and WRN34-10 compared to baselines.
NETWORK
METHOD
CIFAR-I0 (%)
CIFAR-100 (%)
PREACT RN-18
AWP (WU AL., 2020A)
55.39
30.71
AWP + CLAT
58.41
33.97
SWAAT (HWANG ET AI.., 2020)
58.32
28.43
SWAAT CLAT
60.76
30.74
WRN34-10
AWP
58.10
AWP + CLAT
60.89
SWAAT
61.45
31.97
SWAAT CLAT
63.82
34.55
D.6.2. DATA ACGMENTATION TECHNIQUES
Please see Table 15.
Table 15. Adversarial accuracy on CIFAR-IO for PreAct RN-18 (PGD-10) and WRN70-16 (Auto Attack).
NETWORK
METHOD
ADV. Acc. (%)
PREACT RN-18
DATA AUG (WEAK) (LI & SPRATLING, 2023)
50.34
DATA AUG (WEAK) + CLAT
54.01
DATA AUG (STRONG) DATA AUG (STRONG) CLAT
49.99
52.37
WRN70-16
DIFFUSION (WANG ET AL., 2023) DIFFUSION CLAT
70.69
72.34
D.7. Critical Index Variation over Time
Table 16 presents the computed critical indices for DN121, RN50, and RN18, recalculated at epochs 70, 80, and 90 during the 30-epoch fine-tuning phase. Prior to this, adversarial training is conducted without freezing any layers. We observe that critical layer distribution shifts throughout training, though no consistent trend emerges regarding their prominence in earlier or later layers. Combined with our ablation study, where critical layers remain fixed, these results highlight the importance of dynamic layer selection in CLAT.
Table 16. Critical layers identified different epochs for various networks.
NETWORK
EP. 70
EP. 80
Ep. 90
DN121
[39, 14, 1, 3, 88)
[38, 1, 5, 88, 15]
[1 88, 2, 15]
RNSO
[34, 41, 48] [11]
[48, 3, 36]
[36, 2, 20]
RNI8
[11]
[4]
D.8. Critical Index Consistency across Attack Types
To evaluate the robustness of our layer selection metric, we compare the identified indices under different adversarial perturbation strategies. Specifically, we compute the critical indices/layers using untargeted PGD and AutoAttack for three
16

---

Boosting Adversarial Robustness with CLAT: Leivecadity-evveraeee Adversarial Training
(DN121), ResNer-50 (RN50), and ResNet-18 (RN18)on CIFAR-10. As shown in Table 17
below, the selected layers remain identical across both attack types, demonstrating that our metric exhibits strong consistency and is not overly sensitive to the choice of adversarial attack.
Table 17. The same layers are identified by PGD and AutoAttack for all three networks on CIFAR- 10, indicating that the metric is stable and not sensitive choice adversarial attack.
NETWORK
PGD CIDX
AA CIDX
DN121
[39. 14, 3, 88]
[39, 14, 3. 88] [34, 41, 48, 3,36
RN50
[34. 41, 48, 3,3]
RNI8
[11. 2, 12]
[11, 10, 2,
D.9. Critical Layer Visualization
We validate our layer selection by comparing against low-criticality layers in Table 19. Additionally, we include visualization of the criticality index for RN50 at the start of fine-tuning (post 70 epochs of AT), showing clear separation between high- and low-criticality layers (e.g.. 34, 41, 48). Similar patterns hold across architectures and throughout fine-tuning.
Layerwise Criticality Index
0.30
Layars
0.25
Oiticalty peter
0.20
0.15
0.10
10
20
30
40
50
Layer Number
Figure 7. Criticality index for ResNet-50 after 70 epochs of adversarial training. High-scoring layers (c.g., 34, 41, 48) are distinct from low scoring layers.
D.10. Timing Comparisons
For fair comparison, we use the same GPU configuration and number of GPUs across all methods, as described in the methods section. For DN121, one epoch of PGD-AT takes 67 seconds, RiFT takes 56 seconds per epoch, CLAT takes 69 seconds per epoch, and AutoLoRA also takes 69 seconds per epoch. As performed the original paper for optimal performance, RiFT models were adversarially trained for 110 epochs, each taking 67 seconds, followed by fine-tuning for an additional 10 epochs at 56 seconds per epoch. Consequently, the total training time for RiFT is 132 minutes, compared to 112 minutes for CLAT (70 epochs of adversarial training and 30 epochs of fine-tuning).
E. Additional Ablation Studies
E. CLAT on Pretrained Clean Model
Besides the discussion on performing CLAT after adversarial pretraining in Section 4.2, Table 18 details the performance of CLAT on clean pretrained models. Although the adversarial accuracies of clean pretrained models are relatively low
17

---

Boosting Adversarial Robustness with CLAT: Criticality-Leveragee Adversarial Training
compared to those of adversarially trained models, CLAT demonstrates its capability facilitate adversarial fine-tuning clean models effectively some extent. This is novel achievement, showcasing the algorithm's versatility.
Table 18. Adversarial and clean accuracies for performing CLAT
various Py PyTorch pretrained models on the CIFAR-10 datasct.
MODEL
ADV. Acc.
CLEAN ACC.
DN-121
39.21% %
80.89%
WRN70-16 16
42.1%
83.35%
RN-50
35.67%
78.23%
WRN34-10 10
40.1%
81.78%
VGG-19
32.67%
75.05%
RN-18
34.45%
76.51%
E.2. Effect of Choosing the Largest Critical Indices/ Most Critical Layers
our experiments, we fine-tune layers with the highest Cf values, identifying them as the most critical. Fine-tuning layers with the lowest Cy: values, in some sense, aligns with RiFT, which targets the most robust layers and fine-tunes them using clean training objectives. Our method consistently outperforms RiFT across all benchmarks, reinforcing the effectiveness of our approach.
However, since RiFT is fundamentally different, the relevance of Cy is better demonstrated through an ablation study where we fine-tune the "least critical" layers using the CLAT objective, as shown Table 19. As expected, tuning layers with lower Cfe values results in worse performance than tuning the most critical layers but still improves upon the vanilla model.
Table 19. Ablation study of CLAT layer choices CIFAR-10 10. Comparison of clean, 10,-10, and Auto Attack (AA) accuracies when selecting layers with the largest vs. smallest criticality indices. optimal number layers per network was chosen both approaches. All settings follow Table 1.
NETWORK
LARGEST CIDX
SMALLEST CIDX
PGD-AT
CLEAN
PGD-10
AA
CLEAN
PGD-10
AA
CLEAN
PGD-10
AA
DN121
81.03
60.60
49.91
80.50
59.25
48.81
80.05
58.15
47.56
RN50
83.78
59.54
49.45
82.30
57.01
47.10
81.38
56.35
46.22
RN18
83.89
55.37
42.86
82.56
54.01
40.91
81.46
53.63
40.48
E.3. Ablation Study: Dynamic and Fixed Critical Indices
Table 20 presents the computed critical indices for DN121, RN50, and RNI8, recalculated epochs 70, 80, and 90 during the 30-epoch fine-tuning phase. Prior to this, adversarial training is conducted without freezing any layers. We observe that critical layer distribution shifts throughout training, though no consistent trend emerges regarding their prominence in earlier or later layers. These results highlight the importance of dynamic layer selection in CLAT, Across the board, CLAT conducted with dynamic layers outperforms CLAT with fixed layer selection throughout finetuning.
E.4. Clean Accuracy and Critical Layer Selection
Figure 2 illustrates adversarial accuracy trends on CIFAR-10 and CIFAR-100 as a function of the number of selected critical layers. Similarly, Figure 8 presents the corresponding clean accuracy trends. Notably, the optimal number of critical indices for CLAT is consistent across both clean and adversarial accuracy considerations. Highest values are bolded on all the trend lines.
18

---

Boosting Adversarial Robustness with CLAT: Leveead Adversarial Training
CIFAR 10
CIFAR 100
81
DN121 RN50
DN121 RN50
80
58
Accuracy
Accuracy
58
54
52
30
11
15
15
Critical Layers
Critical Layers
Figure& 8. Comparative analysis CLAT performance clean accuracies with respect the number of critical layers used during CLAT.
Table 20, Comparison of CIFAR- 100 clean and adversarial accuracy (PGD-10) on different networks with fixed and dynamic layers for CLAT.
MODEL
METRIC
FIXED LAYERS
DYNAMIC LAYERS
DN121
CLEAN
53.21
58.79
ADV.
39.45
44.12
RN50
CLEAN
55.72
61.88
ADV.
31.89
36.23
WRN34-10
CLEAN
56.45
62.38
ADV.
28.56
32.05
F. Curvature-based Weakness Measurement
The main paper defines feature weakness based on the feature variation under worst-case perturbation. However, due to the non-linear and non-convex nature of the neural network model, the weakness measurement may not be precise in more complicated model architectures with a mixed layer type, such as the Vision Transformer model. To this end, this section provides a more accurate curvature- formulation on feature weakness, and shows how the proposed weakness metric an approximation. We leave the utilization the curvature-based weakness measurement on more complicated models as future work.
Let's start by considering the feature perturbation function Gz(-), which is defined at the output of layer i on inputs close to clean data point x::
G2(2) = [[F((z) F.
The worst-case curvature of the function G3 at the neighborhood of z = x can be estimated following the formulation by Moosavi-Dezfooli et al. (2019) as
v1(x) VGr(z') VG(( || x/12 || x=|2²
(G,(x')
(8)
where x' is worst-case perturbation (adversarial attack) maximizing G((2) in the vicinity of x, and VG,(2) = by
definition given it is minimum. Following the observation by Moosavi-Dezfooli et al. (2019), a higher curvature indicates the feature to be more non-robust to adversarial examples. We can therefore use the curvature formulation vs (z) under fixed perturbation budget ||æ' - <IIp < to estimate the layer non-robustness, or weakness.
As we use the feature weakness to derive both the layer criticality metric and the finetuning objective, having a gradient term in the layer weakness leads to the costly computation of higher-order gradients in the optimization. To avoid the high cost of
19

---

Boosting Adversarial Robustness with CLAT: Leveeae Adversarial Training
computing higher-order gradients when optimizing with the curvature, the numerator in the curvature formulation be further derived
(F((x')
(Fi(x") F.(x))
14 (3)
a 2:12
In practice, is also difficult to explicitly instantiate (F,(x") Oz'
for neural network. To this end, we simplify the formulation as a uniform vector. This leads to our definition of e-weakness of layer i's feature
Equation (9) by assuming (F((2
as:
(c(F.) 1
Ex sup [[ + 6) Fx)2 S1
(10)
N₂
where Nj denotes the dimensionality of the output features at layer i, therefore normalizing the weakness measurement of layers with different output sizes. The weakness measurement is proportional to the curvature estimation in Equation (9). higher weakness value indicates that the feature vector is more vulnerable to input perturbations. The functionality of cascading layers from to affects the vulnerability of the hidden features, as described by this formulation.
20


Reviews:
[{"review_id": "vVE2GHmX4l", "reviewer": "Reviewer_9V5S", "summary": "This paper proposes a criticality index to identify critical layers that are more prone to perturbation and then apply CLAT to fine-tune these layers for better clean and adversarial accuracy. Results are evaluated on various models, methods and datasets, proving the effectiveness of CLAT.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We’re grateful for your insightful comments and for appreciating the care we put into our experiments. Below, we offer detailed responses to each of your points.\n\n**Marginal improvement:** We respectfully disagree. Gains of ~2% in adversarial robustness—particularly through fine-tuning—are considered meaningful in recent work (e.g., RiFT [1] reports average improvements of ~1.4%).\n\n\nIn addition, CLAT introduces a distinct and lightweight mechanism for identifying structurally important layers, based on their sensitivity to input perturbations. CLAT’s ability to improve robustness from scratch—across training settings and learning rates—while updating under 5% of parameters suggests these layers are inherently robust-relevant, not artifacts.  \n\n**Critical Layers:** We also validate our layer selection by comparing against low-criticality layers (Appendix E.3). Additionally, thanks for the suggestion—we now include a visualization of the criticality index for RN50 at the start of fine-tuning (post 70 epochs of AT), showing clear separation between high- and low-criticality layers (e.g., 34, 41, 48). Similar patterns hold across architectures and throughout fine-tuning.\nLink for image: https://imgur.com/a/iNKlttr\n\n\n**Cidx consistency:** The identified critical layers remain stable across perturbation types. For instance, indices computed using AutoAttack closely match those from untargeted PGD for DN121, RN50, and RN18 on CIFAR-10.\n\n\n| **Network** | **PGD CIDX**           | **AA CIDX**            |\n|-------------|------------------------|------------------------|\n| DN121       | [39, 14, 1, 3, 88]     | [39, 14, 1, 3, 88]     |\n| RN50        | [34, 41, 48, 3, 36]    | [34, 41, 48, 3, 36]    |\n| RN18        | [11, 10, 4, 2, 12]     | [11, 10, 4, 2, 12]     |\n\n\n**Additional Results:** We agree and are happy to move the ImageNet and random ablations into the main paper, space permitting. They were placed in the appendix due to the broader use of CIFAR datasets for baseline comparison.\n\n[1] Zhu, K., Wang, J., Hu, X., Xie, X., & Yang, G. (2023). *Improving generalization of adversarial training via robust critical fine-tuning*. arXiv preprint arXiv:2308.02533.", "claims_and_evidence": "My major concern is that despite the soundness of finding critical layers for emphasized AT, the entire theory is based on existing findings without much advancement. The improvement, although consistent across methods, models and datasets, is relatively limited (~2%). This may also suggest that the identification of critical layers may not contribute as significantly as expected to adversarial robustness.", "methods_and_evaluation_criteria": "Methods are intuitive and easy to understand. Evaluations are primarily comprehensive.", "theoretical_claims": "There are no outstanding theoretical claims or analysis in this paper.", "experimental_designs_or_analyses": "Experiments have been persuasive as the paper includes multiple methods and models. It also includes results from ImageNet and randomly selected layers as a comparison with CLAT to demonstrate the soundness of the method, which is satisfactory. However, considering the significance of the former experiments, I would recommend including these results into the main paper.", "relation_to_broader_scientific_literature": "The idea is consistent with existing research and aligns with scientific consensus within AT and robustness overfitting. Methods are consistent across models and datasets, despite the relatively limited improvement. Overall, the contribution would be moderate.", "essential_references_not_discussed": "N/A.", "other_strengths_and_weaknesses": "N/A.", "other_comments_or_suggestions": "N/A.", "questions_for_authors": "1. Apart from using randomly selected layers as a comparison group to show the effectiveness criticality, is there a more straightforward way to show that the chosen layers are the desired vulnerable layers? For example, visualizing the output variation of a number of layers including the critical and non-critical ones. \n2. Will the critical layers vary given different perturbations? For example, CLAT uses untargeted perturbation. Will the shift of perturbation results in a different selection of critical layers?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uRX2QJJo6T", "reviewer": "Reviewer_8QH8", "summary": "The paper introduces CLAT (Criticality-Leveraged Adversarial Training), which aims to enhance the adversarial robustness of neural networks by identifying and fine-tuning critical layers that are most vulnerable to adversarial attacks. The main contributions include the development of a criticality index for layer selection and a fine-tuning objective to reduce the non-robust features of these layers. The authors claim that CLAT improves both clean accuracy and adversarial robustness while mitigating overfitting.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you so much for your time! Below, we’ve provided detailed responses to each of your concerns and criticisms. We hope this helps clarify everything.\n\n**Experimental support and breadth of evaluation:**  \nRespectfully, we disagree with the concern regarding insufficient experimental support. As also noted by **Reviewers 9V5S and eBwd**, our submission presents a comprehensive and thoughtfully designed evaluation. We test CLAT across four diverse datasets (CIFAR-10, CIFAR-100, Imagenette, and ImageNet), multiple CNN architectures, and in conjunction with several adversarial training methods, including state-of-the-art approaches from RobustBench. These include both models trained from scratch and partially pretrained models.\n\nTo our knowledge, CLAT is the first fine-tuning method that can also be applied from scratch, demonstrating flexibility across training regimes. Despite this broad applicability and strong performance, CLAT introduces negligible overhead, requiring no backward passes or gradient computations for layer selection. We further support our claims with targeted ablation studies that isolate the contribution of each component.\n\nWhile we cannot exhaustively include every prior method, we carefully prioritized baselines that reflect challenging, high-performing adversarial training settings. Several well-regarded SOTA methods accepted at top-tier venues conduct fewer evaluations in terms of dataset and model diversity. If there are specific baselines or comparisons the reviewer would like us to include, we are happy to provide additional results or clarify their exclusion.\n\n**Finetuning method:**  \nYes, CLAT is a fine-tuning method by design—and this is a core strength. It introduces a layer-selective strategy that mitigates overfitting and consistently improves both clean and adversarial performance. The proposed criticality index identifies layers still learning non-robust features that benefit from continued optimization.\n\nAs a fine-tuning method, CLAT is modular, integrates easily into existing adversarial training pipelines, and adds minimal overhead. Its ability to be applied from scratch further highlights the relevance of the selected layers and the generality of the approach.\n\nMore broadly, fine-tuning and adversarial training are not mutually exclusive. Fine-tuning has emerged as a valuable direction for improving robustness and has been recognized at top-tier venues [1].\n\n**Novelty and ALP:**  \nCLAT is, to our knowledge, the only method that achieves state-of-the-art robustness across diverse training setups, by fine-tuning fewer than 5% of parameters with minimal overhead and no backward pass required for layer selection.\n\nCLAT also introduces a distinct training objective compared to prior work such as Adversarial Logit Pairing (ALP) [2]. While ALP adds a global logit-level regularizer to align clean and adversarial outputs, CLAT uses a forward-pass-only feature sensitivity metric to select a small subset of layers and applies a layerwise regularizer to penalize their vulnerability. This objective targets internal robustness rather than output-level alignment and constrains optimization structurally and locally, in contrast to ALP’s full-model training.\n\nThis combination of non-gradient-based sensitivity analysis, feature-level regularization, and sparse fine-tuning defines a lightweight and general framework that is fundamentally distinct from prior approaches.\n\n**Marginal improvements:**  \nPlease see our response to **Reviewer 9V5S** regarding this concern.\n\n**Transformer-based models:**  \nVision Transformers represent a fundamentally different architectural paradigm with structural properties that diverge significantly from CNNs. While this is an important direction, it is outside the scope of this work, which focuses on the structural role of layer selection in CNN-based adversarial robustness. Preliminary results of CLAT on TinyVIT showcase an increase in both clean and adversarial accuracy by approximately 3%.\n\n---\n\n**References**  \n[1] Zhu, K., Wang, J., Hu, X., Xie, X., & Yang, G. (2023). *Improving generalization of adversarial training via robust critical fine-tuning*. arXiv preprint [arXiv:2308.02533](https://arxiv.org/abs/2308.02533).  \n[2] Kannan, H., Kurakin, A., & Goodfellow, I. (2018). *Adversarial logit pairing*. arXiv preprint [arXiv:1803.06373](https://arxiv.org/abs/1803.06373).", "claims_and_evidence": "The claims made in the submission are not sufficiently supported by novel or convincing evidence. The method proposed is more akin to a fine-tuning approach rather than a novel adversarial training method. The primary contribution lies in the selection of critical layers using the criticality index (Equation 3). However, the adversarial training loss (Equation 5) is not innovative and has been commonly used in other regularization techniques such as logits pairing [1] and some other follow-up papers. Despite the authors' claims that the feature weakness defined in Equation (2) approximates the local curvature value, the overall method lacks novelty and significance in the context of adversarial training, to the reviewer's knowledge.\n[1] Adversarial logit pairing, 2018", "methods_and_evaluation_criteria": "The proposed methods, while relevant to the problem of adversarial robustness, do not introduce substantial advancements over existing techniques. The criticality index and the fine-tuning objective are conceptually interesting but do not represent a significant departure from current practices.", "theoretical_claims": "The theoretical claims regarding the criticality index and its relationship to feature weakness are adequately presented but do not provide a strong basis for novelty. The connection between the proposed feature weakness metric and local curvature is not sufficiently explored or validated to support the claims of innovation.", "experimental_designs_or_analyses": "The experimental designs appear insufficient to validate the significance of the proposed method. \n\n1. The authors tested CLAT on several datasets (CIFAR-10, CIFAR-100, Imagenette, and ImageNet) and network architectures, but the improvements over baseline adversarial training methods are marginal, as shown in Table 1,2,3,4.\n\n2. The experiments lack breadth, as they do not include more recent backbone architectures (e.g., Vision Transformers).\n\n3. Furthermore, the comparisons with other state-of-the-art adversarial training methods are inadequate, limiting the strength of the conclusions drawn.", "relation_to_broader_scientific_literature": "The key contributions of the paper are related to existing work in adversarial training and layer-specific fine-tuning. However, the proposed method does not significantly advance the field beyond current practices. The paper cites relevant literature but fails to distinguish itself from prior work in terms of innovation or impact.", "essential_references_not_discussed": "The paper does not adequately discuss recent advancements in adversarial training that focus on layer-specific interventions or architectural modifications. The methods that explore the use of specialized layers or modules for enhancing robustness should be included to provide a more comprehensive context.", "other_strengths_and_weaknesses": "1. The method proposed by the author is more like a fine-tuning method than an adversarial training method. \n\n(1)The main contribution of this paper is to propose a method for selecting critical layer in eq.3. \n\n(2)Loss for adversarial training, in eq.5, is the commonly used training method, for example, with the interpretation and definition of design eq.5 in logits pairing [1] . Although the authors claim that feature weakness defined in Equation (2) is also an effective approximation to the local curvature value, the proposed method is still lacking in innovation and importance from the perspective of adversarial training.\n\n[1] Adversarial logit pairing, 2018\n\n2. The experimental designs are insufficient to validate the significance of the proposed method. \n\n(1)The authors tested CLAT on several datasets (CIFAR-10, CIFAR-100, Imagenette, and ImageNet) and network architectures, but the improvements over baseline adversarial training methods are marginal, as shown in Table 1,2,3,4.\n\n(2)The experiments lack breadth, as they do not include more recent backbone architectures (e.g., Vision Transformers).\n\n(3)Furthermore, the comparisons with other state-of-the-art adversarial training methods are inadequate, limiting the strength of the conclusions drawn.", "other_comments_or_suggestions": "No", "questions_for_authors": "see my comments about strength and weakness.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nsrGDLsLDY", "reviewer": "Reviewer_eBwd", "summary": "The paper aims to make adversarial training more efficient by selectively training only the most critical layers based on a criticality factor. This factor is determined using the local Lipschitz constant, calculated as the average difference in a layer's features with and without adversarial perturbations added to the input. The identified \"critical\" layers are then trained by incorporating a regularization term into the objective function. Results on multiple datasets demonstrate performance improvements.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful feedback and for recognizing the experimental rigor of our work. Below, we respond to each of your concerns and questions.\n\n**Novelty:** Please see the “Novelty” section in our response to Reviewer **8QH8**. For a concrete comparison, consider RiFT [1], a fine-tuning method that also updates a subset of layers. While effective, RiFT identifies redundant layers using weight perturbations, whereas CLAT uses input perturbations to identify layers most responsible for adversarial vulnerability. CLAT consistently outperforms RiFT and other baselines across datasets and architectures (see Tables 1 and 2).  \nIf there are other methods the reviewer believes are directly comparable, we would be happy to clarify distinctions.\n\n**Further analysis:** Thank you for highlighting this point. We analyze layer selection across models, datasets, and training settings—examining the number of layers selected and when fine-tuning should begin. We also include multiple ablation studies verifying the impact of selected layers. Our response to Reviewer **9V5S** under “Cidx consistency” shows that critical indices remain stable regardless of perturbation type.\n\nWe agree that deeper insight into why certain layers emerge as more important—perhaps due to architectural roles or training dynamics—would be valuable. As our focus is on practical improvements to robustness, we limit scope accordingly.\n\n**Additional baselines:** Our submission prioritized SOTA methods, strong threat models (e.g., PGD, AutoAttack), and widely adopted training protocols. Below, we compare against omitted fine-tuning methods using their best-performing models and original settings. As shown, CLAT outperforms these methods—even under stronger attacks.\n\n> **Note:** FGSM is substantially weaker than PGD due to its single-step nature.\n\n### Comparison with Additional Baselines\n\n| **Method**     | **Model**    | **Attack**                | **Adv. Accuracy** |\n|----------------|--------------|---------------------------|-------------------|\n| [3]            | VGG-19       | FGSM, ε = 0.1             | 68.37             |\n| **[3] + CLAT** | VGG-19       | FGSM, ε = 0.1             | **78.55**         |\n| [5]            | ResNet-18    | iFGSM, ε = 8/255          | 46.29             |\n| **[5] + CLAT** | ResNet-18    | iFGSM, ε = 8/255          | **59.95**         |\n| [6]            | WRN28-10     | PGD-50-10, ε = 8/255      | 47.06             |\n| **[6] + CLAT** | WRN28-10     | PGD-50-10, ε = 8/255      | **58.62**         |\n| [8]            | ResNet-20    | PGD-20, ε = 8/255         | 51.07             |\n| **[8] + CLAT** | ResNet-20    | PGD-20, ε = 8/255         | **54.20**         |\n| [9]            | ResNet-50    | PGD-10, ε = 8/255         | 43.70             |\n| **[9] + CLAT** | ResNet-50    | PGD-10, ε = 8/255         | **53.67**         |\n\n**Clarifications:**\n- [3] Uses FGSM and perturbs all layers, with high overhead and limited robustness.  \n- [4] Superseded by stronger methods like *Fast is Better than Free* [10], which we include.  \n- [5] Underperforms under PGD.  \n- [6] Perturbs three fixed layers; does not adapt to model structure or input sensitivity.  \n- [7] Targets large-scale training; less relevant to models like ResNet-18, WRN-34-10.  \n- [8] Modifies BatchNorm; orthogonal to CLAT’s selective fine-tuning objective.  \n- [9] No longer SOTA, but CLAT improves its performance when combined.\n\n**Writing:** Noted on writing style and complex phrasing. We will incorporate these refinements in the camera-ready version.\n\n**References**  \n[3] Regularizing Deep Networks Using Efficient Layerwise Adversarial Training: Sankaranarayanan, S., Jain, A., Chellappa, R., & Lim, S. N. (2018). Proceedings of the AAAI Conference on Artificial Intelligence, 32(1).  \n\n[4] Free Adversarial Training with Heuristic Layerwise Perturbation: Zheng, H., Zhang, M., & Huang, H. (2020). arXiv preprint arXiv:2010.03131.  \n\n[5] Yang, Z., Liu, Y., Bao, C., & Shi, Z. (2020). Layer-wise Adversarial Defense: An ODE Perspective. International Conference on Learning Representations (ICLR).\n\n[6] Reliably Fast Adversarial Training via Latent Adversarial Perturbation: Park, G. Y., & Lee, S. W. (2021). Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 7758-7767\n\n[7] Intriguing Properties of Adversarial Training at Scale: Xie, C., & Yuille, A. (2019). arXiv preprint arXiv:1906.03787. https://arxiv.org/abs/1906.03787\n\n[8] Adversarial Attacks and Batch Normalization: Muhammad, A., Shamshad, F., & Bae, S.-H. (2023). IEEE Access, 11, 96449-96459. https://doi.org/10.1109/ACCESS.2023.3250661\n\n[9] Smooth Adversarial Training: Xie, C., Tan, M., Gong, B., Yuille, A., & Le, Q. V. (2021). arXiv preprint arXiv:2006.14536. https://arxiv.org/abs/2006.14536\n\n[10] Wong, E., Rice, L., & Kolter, J. Z. (2020). Fast is better than free: Revisiting adversarial training. arXiv. https://arxiv.org/abs/2001.03994.", "claims_and_evidence": "The paper makes two major claims: (1) layer-wise adversarial training can be more efficient, and (2) it can improve both robustness and clean accuracy. These claims are sufficiently supported by experimental evidence. However, they are not adequately compared with existing works that also utilize layer-wise training.", "methods_and_evaluation_criteria": "The benchmarks used for evaluation are reasonable for the method. However, the novelty and originality of the approach are limited given prior work.", "theoretical_claims": "No theoretical claims are made.", "experimental_designs_or_analyses": "I have examined the experimental design, including the robustness of CLAT against various adversarial attacks across different datasets and models, and found it to be reasonable. However, the paper lacks a strong analysis. For instance, each model has different critical layers, and it would be interesting to see a deeper analysis of this phenomenon.", "relation_to_broader_scientific_literature": "This paper aims to reduce the cost of adversarial robustness by training selective layers. A significant body of work has explored this topic from different angles.", "essential_references_not_discussed": "There is a significant body of work on adversarial attacks and robustness at the layer and architectural level, dating back to 2017. However, these papers are not properly discussed in this paper. A few example papers are given in the following. \n\nRegularizing Deep Networks Using Efficient Layerwise Adversarial Training (https://arxiv.org/pdf/1705.07819)\n\nFree Adversarial Training with Layerwise Heuristic Learning\n\nLayer-wise Adversarial Defense: An ODE Perspective (https://openreview.net/forum?id=Ef1nNHQHZ20)\n\nIntriguing properties of adversarial training at scale (https://arxiv.org/abs/1906.03787)\n\nAdversarial Attacks and Batch Normalization: A Batch Statistics Perspective (https://ieeexplore.ieee.org/abstract/document/10056932)\n\nSmooth Adversarial Training (https://arxiv.org/abs/2006.14536)\n\nReliably fast adversarial training via latent adversarial perturbation (https://openaccess.thecvf.com/content/ICCV2021/html/Park_Reliably_Fast_Adversarial_Training_via_Latent_Adversarial_Perturbation_ICCV_2021_paper.html)", "other_strengths_and_weaknesses": "The writing needs improvement. Additionally, it would be useful to relate the work to previous papers that are closely aligned with the proposed approach.", "other_comments_or_suggestions": "I would advise the authors to avoid using overly complex phrases when describing their method, such as \"a paradigm shift\" (L45-46).", "questions_for_authors": "No questions.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XNQhFg4amO", "reviewer": "Reviewer_fHnS", "summary": "The paper presents CLAT, a layer-aware adversarial training algorithm designed to mitigate adversarial overfitting by identifying and fine-tuning layers that learn non-robust features. The approach leverages layer criticality, a metric that quantifies a layer’s functional importance to subsequent features, to pinpoint critical layers for targeted fine-tuning. Experimental results demonstrate that CLAT enhances the adversarial robustness of existing methods, suggesting its effectiveness in improving model resilience against adversarial attacks.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful questions and suggestions. We address each point below.\n\n**Finetuning from beginning / CLAT for training:** CLAT can indeed be applied from the beginning, without any prior training, as well as after standard adversarial training. This directly addresses your suggestion of using the identified layers during the main adversarial training process.\n\nAs shown in Figure 1 (see the “CLAT for 100 epochs” curve), training only the identified critical layers from scratch eventually surpasses baseline adversarial training methods—demonstrating that CLAT is not limited to post hoc fine-tuning. While convergence is slower, final performance is higher than PGD-AT, reinforcing the utility of these layers during training itself. Lines 315–325 in the main text and Figure 5 in the appendix further support this observation with full training trajectories.\n\nUsing TRADES instead of PGD-AT mirrors these trends, with CLAT consistently improving performance when applied from scratch or as a fine-tuning step (see finetuning results in Table 1 and Table 2). In summary, CLAT is not merely an add-on to existing methods, but a flexible and general mechanism for improving adversarial robustness, whether applied during or after training.\n\n**Different objective:** Continuing to optimize the standard adversarial loss after the model has already been trained often leads to degradation in generalization on clean data—a well-documented issue in adversarial training. To address this, we introduce a joint objective in Stage 2 that combines cross-entropy loss with a criticality term (Equation 6). This encourages the model to reduce reliance on non-robust features within the most sensitive layers, while still preserving performance on clean inputs. This insight and formulation are discussed in lines 158–174 of the paper.\n\nThe balance between the two terms is controlled by the hyperparameter λ, which we find to be stable across datasets and architectures. In practice, λ enables a smooth trade-off between robustness-enhancing updates and accuracy-preserving behavior during fine-tuning.\n\n**More experiments to show identified layers are important:** We believe our current experiments already provide strong support for the importance of the identified layers and **reviewers eBwd and 9V5S** both agree on the comprehensiveness of our evaluation. We conduct multiple ablations to highlight this, including: (1) comparing performance when fine-tuning critical versus random layers, (2) analyzing the effect of selecting layers with the lowest versus highest CIDX values, and (3) evaluating the consistency of selected critical layers across batch sizes and datasets for a fixed architecture—amongst several other results in the main paper and appendix.\n\nAdditionally, we provide evidence (see response on “consistency” to **Reviewer 9V5S**) that the identified critical layers remain consistent across different adversarial attacks used to compute them. We are happy to incorporate this into the appendix for completeness. Together, these experiments consistently demonstrate that the identified layers are not only meaningful, but central to CLAT’s improvements in both clean and adversarial accuracy.\n\n**Critical layer definition:** Layer criticality refers to the extent to which individual layers contribute to adversarial vulnerability. We define this empirically by measuring how much each layer’s output changes when the input is perturbed adversarially—assigning higher scores to layers that exhibit larger activation shifts (Equation 5).\n\nWhile the term “criticality” is new in this context, the idea relates to prior work on layerwise sensitivity, pruning, and fine-tuning for robustness [1]. However, such methods typically focus on redundancy reduction or apply global training updates. In contrast, CLAT introduces a novel, lightweight, and scalable mechanism to identify and leverage structurally important layers for improving adversarial robustness.\n\nWe present theoretical motivation and justification for this formulation in the Methods section and Appendix F, and **Reviewer 8QH8** specifically noted the thoroughness of this explanation. We agree that a deeper theoretical understanding of certain phenomena—such as why specific layers consistently emerge as more critical—would be valuable, and we view this as an exciting direction for future work.\n\nNonetheless, our empirical results—including comparisons with random and non-critical layers, consistency across datasets, attacks, and batch sizes, and consistent performance gains—provide strong support for the validity and utility of our criticality measure.", "claims_and_evidence": "The paper proposes a way to identity important layers for adversarial robustness. However, the actual method includes the first stage of \"pretraining\" using prior methods, presumably on all the layers. It is unclear to me\n1. If these layers are more critical, why not only finetune them from the beginning?\n2. Why using different objective in stage 2, where the criticality is minimized instead of the adversarial loss?\n\nI think that the paper can benefit from more experiments to support the claim that the identified layers are indeed important.", "methods_and_evaluation_criteria": "1. The definition of layer criticality is not clear to me. The paper can benefit more if the author can ground this concept into prior literature, or using some theoretical results to back it up.", "theoretical_claims": "No theoretical contents", "experimental_designs_or_analyses": "The evaluation focuses on existing adversarial training method + CLAT. However, since CLAT is mainly for identifying important layers for training, it should make more sense to use these layers for adversarial training too.", "relation_to_broader_scientific_literature": "The paper takes an architecture-centric approach by identifying critical layers within the network, which is orthogonal to most adversarial training methods that primarily focus on designing new loss functions.", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "Strengths\n1. The baselines are comprehensive, including AWP and SWA which also aim to mitigate robust overfitting. \n2. This method seems to be compatible with most of the robust training method.", "other_comments_or_suggestions": "None", "questions_for_authors": "Can you finetune the model using your identified layers from scratch, using traditional robust training methods (trades, AT)? Will the results become better than fine-tuning on all layers?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes to identify robustness-critical layers and use only parameters of these layers in adversarial fine-tuning. This initial reviews were quite diverging. Reviewers acknowledge the potential benefit of the proposed approach in making adversarial training more efficient, but are also critical about the novelty (combination of existing findings), actual contribution of the criticality,  and the experimental evaluation. With the additional results provided in the rebuttal, the AC finds the paper can meet the bar for ICML, because the proposed approach provides a consistent improvement and is intuitive and well motivated. The authors should include the additional results from the rebuttal to the final paper.
Decision: Accept (poster)