Quadratic Upper Bound for Boosting Robustness
Authors: Euijin You
Hyang-Won Lee
Venue: ICML 2025 poster (2025)
Keywords: Robustness
Adversarial Attack
Fast Adversarial Training
Quadratic upper bound
Primary area: deep_learning->robustness
TL;DR: We propose a quadratic upper bound (QUB) loss to improve the robustness of fast adversarial training (FAT) by addressing insufficient adversarial space exploration.

Abstract: Fast adversarial training (FAT) aims to enhance the robustness of models against adversarial attacks with reduced training time, however, FAT often suffers from compromised robustness due to insufficient exploration of adversarial space. In this paper, we develop a loss function to mitigate the problem of degraded robustness under FAT. 
Specifically, we derive a quadratic upper bound (QUB) on the adversarial training (AT) loss function and propose to utilize the bound with existing FAT methods. Our experimental results show that applying QUB loss to the existing methods yields significant improvement of robustness. Furthermore, using various metrics, we demonstrate that this improvement is likely to result from the smoothened loss landscape of the resulting model.

Quadratic Upper Bound for Boosting Robustness
Euijin You
Hyang- Won Lee'
Abstract
gradient-based iterative method that updates perturbations in the direction that maximizes the loss to explore stronger attacks. There are several other approaches that generate adversarial examples by introducing more sophisticated loss functions (Zhang et al., 2019; Wang et al., 2019). While these approaches can effectively enhance the robustness, they often require consuminn and computationally ex- pensive training due mainly to the need for generating high- quality examples and performing iterative optimization.
Fast adversarial training (FAT) aims to enhance the robustness of models against adversarial at- tacks with reduced training time, however, FAT often suffers from compromised robustness due to insufficient exploration of adversarial space. In this paper, we develop a loss function to improve robustness in FAT without requiring stronger inner maximization. Specifically, we derive quadratic upper bound (QUB) on the adversarial training (AT) loss function and propose to utilize the bound with existing FAT methods. Our experi- mental results show that applying QUB loss to the existing methods yields significant improvement of robustness. Furthermore, using various metrics, we demonstrate that this improvement is likely result from the smoothened loss landscape of the resulting models.
To address this issue, the concept of fast adversarial train- ing (FAT) has emerged (Shafahi et al., 2019). FAT utilizes single-step attacks instead of multi-step attacks, enabling faster and more cost-efficient training, and hence, allows for only a cours--grained exploration of the adversarial space. As a result, FAT often suffers from catastrophic overfitting (Wong al., 2020), where the model becomes excessively robust to the adversarial examples encountered during train- ing while compromising robustness against unseen attacks.
Various FAT methods have since been proposed to over- come catastrophic overfiuting and improve performance (An- driushchenko & Flammarion, 2020; Kim et al., 2021; Srira- manan al., 2020; 2021; Jia et al., 2022a). By analyzing the causes of the problem and approaching it from new perspectives, these methods have demonstrated improved robustness, even with reduced training time.
1. Introduction
Deep neural networks have shown remarkable performance in various tasks like image classification and speech recog- nition, bringing innovation in real-world applications. How- ever, these models have been found to be vulnerable to adversarial attacks (Goodfellow et al., 2015). These attacks involve adding small perturbations to the data to mislead the model into making incorrect predictions, severely compro- mising its reliability.
In this paper, we propose a simple loss function designed to enhance robustness without significantly affecting the short training time of FAT. We derive a quadratic upper bound (QUB) on the AT loss function by relying on the fact that the cross-entropy loss function is convex with respect to logits. The bound can indeed be viewed as a combination of the terms for accounting for robust accuracy as well as standard accuracy. We propose to utilize the bound for adversarial training instead of the original AT loss function. Experi- mental results show that our QUB can further enhance the robustness of existing AT methods without significantly in- creasing training time. We also analyze various metrics and demonstrate that employing QUB has the effect of smooth- ing the loss landscape with respect to perturbations, which contributes to enhanced robustness.
Adversarial training (AT) (Madry et al., 2018) is the most common defense method to address this issue. It generates adversarial examples by perturbing the input data during the training process and trains the model with these examples to improve robustness. Accordingly, the robustness of the model obtained by AT depends heavily on the quality of generated adversarial examples. A well-known approach, projected gradient descent (PGD) (Madry et al., 201 8), is
DDpartment of Computer Science and Engineering, Konkuk University, Scoul, South Korea. Correspondence to: Hyang-Wor Won Lee <lechw @ ar.
The contributions of this paper can be summarized as fol- lows:
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Quadratic Upper Bound for Boosting Robustness
Proposal of QUB Loss: We derive a quadratic upper bound (QUB) the adversarial training loss fune- tion by using the convexity of cross-entropy loss with respect to logits.
where (Bx().,)))) denotes the projection onto the e-ball around xt. In this method, the image is iteratively updated with small step size a. If the resulting perturbation ex- ceeds the e-bound, it is projected back onto the e-ball to ensure that the constraints are satisfied. PGD obviously gen- crates more powerful attacks than FGSM due to its iterative updates, which potentially makes it to converge to the point where the loss is maximized.
We develop an FAT method with QUB loss that can improve model robust- ness by simply replacing the loss function.
FAT Method with QUB Loss:
Experimental Performance Validation: We do not only demonstrate improved robustness on various dataset but also analyze the impact of our QUB loss on the loss landscape using various metrics.
2.2. Adversarial Training
To enhance robustness against adversarial attacks, adversar- ial training was proposed, where adversarial examples are generated and used to train the model (Madry et al., 201 2). The min-max optimization problem of adversarial training is written as follows:
2. Related Work
2.1. Adversarial Attack
Adversarial Attack refers the method of adding small perturbations to the input data that intentionally degrade the model's performance. In this paper, focus on attacks in image classification. In the following, fo(-) refers to an artificial neural network with parameter 0, and L denotes the loss function. The adversarial attack aims to find a perturbation, denoted as 6, that maximizes the so-called AT loss function as follows:
min max L(fe(1 + 0), 0 16
(4)
where the inner maximization seeks perturbations that maxi- mize the loss, and the outer minimization updates the model parameters to minimize this worst-case loss. This approach aims to train the model to make accurate predictions even when it encounters perturbed inputs. By doing so, the model can achieve robustness not only in clean image classifica- tion but also in the presence of intentional attacks. Later, TRADES (Zhang et al., 2019), which aims to align the model's output distributions before and after the attack, demonstrated superior robustness performance.
max C(fo( + 8),9). 0 St
(1)
where Typ norm constraint ensures that the perturbed input x+6 lies within the e-ball (xx, e) centered at the input æ. In many studies, the Los -norm is typically adopted, as allows for the widest range of attacks (or perturbations) for the same value of c. Since this optimization problem (1) is non- convex, finding the exact optimal solution is very difficult. Therefore, gradient-ben prudient-based methods have been proposed to approximate the solution.
2.3. Fast Adversarial Training
In adversarial training. perturbations must be generated for all training data train the model. However, multi-step update processes, such PGD, require substantial computa- tional resources and can lead to excessively longer training times. To address this issue, fast adversarial training (FAT) methods have been developed, which generate perturbations in a single step for faster training, such as FGSM in (2).
The fast gradient sign method (FGSM) (Goodfellow et al., 2015) is a simple gradient- based attack that adjusts x in the direction of the gradient of the loss as follows:
However, as demonstrated in (Madry et al., 2018), the mod- els trained with FGSM exhibit lack of robustness to PGD attacks. This is attributed to FGSM's ss reliance on single- step update, which proves inadequate for identifying effec- tive attack points. Free-AT (Shafahi et al., 2019) aims to replicate the iterative nature of PGD by generating adver- sarial examples through a single backward pass, efficiently combining the robustness of iterative attacks with reduced computational overhead. FGSM-RS (Wong et al., 2020) simplifies Free-AT's approach by incorporating random starts, which enables to explore more diverse perturbation space. N-FGSM (de Jorge Aranda et al., 2022) strengthens single-step adversarial training by using stronger noise and removing gradient clipping, which prevents catastrophic overfitting.
Tadv = x + e sign( V (=((fo(z), v)).
FGSM generates adversarial examples with a single gradient calculation, allowing attacks to be performed in a short time. However, it has the limitation of adding perturbations by fixed amount c, thus failing to sufficiently explore all potential attack points within the e-ball.
Projected gradient descent (PGD) (Madry et al., 2018) is an iterative gradient-basee based method that generates stronger attacks, providing direct approach to solve problem (1). In the t-th iteration, the adversarial example T,, representing the perturbed image after t iterations, is updated as follows:
I1+1 -I (xx + a e-sign(VV. 8))),
(3)
2

---

Quadratic Upper Bound for Boosting Robustness
Furthermore, many of the aforementioned FAT methods can suffer from catastrophic overfitting, which is phenomenon that the model's robustness dramatically decreases against PGD attacks during training. This occurs when the model becomes excessively sensitive to adversarial attacks or over- fits to specific types of perturbation (Kurakin et al., 2017: Tramèr et al., 2018; Lin et al., 2024b). As a result, the model may successfully defend against the attack types it was trained on but loses defense capability against more advanced attacks generated in different ways. Several im- proved FAT methods have been proposed to resolve this issue, and we discuss those methods in the following.
mini-batch, rather than processing each data sample inde- pendently. A regularizer was designed to align the pertur- bation direction of FGSM with the loss gradient direction, compensating for the drawbacks of FGSM while achieving performance close to PGD-based training. FAT-CS (Zhao et al., 2023) proposed a regularizer to stabilize the loss convergence process, addressing the issue of catastrophic overfitting, which is often accompanied by sudden changes in loss. FGSM-LAW (Jia et al., 2024a) introduced Lips- chitz regularization and auto weight averaging methods to comprehensively improve the model's robustness. Layer- Aware Adversarial Weight Perturbation (LAP) (Lin et al., 2024c) analyzed the varying degree of distortion across lay- ers and applied adaptive weight perturbations to different layers to enhance robustness. ELLE (Rocamora et al., 2024) refines local linearity regularization, with ELLE reducing computational overhead by linking regularization to loss curvature.
Regulating Attack Intensity with Step Size Adjustment
FGSM-CKPT (Kim et al., 2021) avoids direct updates with large step sizes in the adversarial direction, and instead in- troduces checkpoints to generate better attacks with varying step sizes. ATAS (Huang et al., 2023) identifies fixed step sizes as a cause of catastrophic overfitting and addresses this by introducing an adaptive step size, which adjusts the perturbation size based on the loss variation.
Other Approaches
Sub-AT (Li et al., 2022) enhances adversarial training by extracting subspaces in the latent space. Dropout schedul- ing (Vivek & Babu, 2020) prevents gradient masking, while ZeroGrad (Golgooni et al., 2023) removes weak perturba- tions to improve learning. DOM (Lin et al., 2024a) miti- gates over- werrmeemrizzatinn by adjusting high-confidence pre- dictions. SLAT (Park& & Lee, 2021) normalizes feature gradients by applying perturbations in the latent space.
Enhancing the Initial Points of Attacks
The robustness of the trained model depends heavily on the initial point of attack, and consequently, several papers have explored improved initialization techniques. FGSM-SDI (Jia et al., 2022b) uses a generator to create perturbations in conjunction with the model, enabling the learning of adversarial attacks tailored to each sample. FGSM-PGI (Jia et al., 2022a) and FGSM-PGK (Jia et al., 2024b) are representative of prior-guided initialization methods, where perturbations from previous epochs are stored and used as initial points for attacks in the next epoch, achieving better performance with only a single step. FGSM-UAP (Pan et al., 2024) proposes a method using a small number of Universal Adversarial Perturbations (UAPs), saving memory while performing strong attacks without storing individual perturbations for whole images.
Many of the previous works (using the original AT loss function) have focused the generation of sophisticated adversarial examples or on the design of regularizers for boosting robustness. Our approach differs from those AT methods in that we derive an upper bound on the AT loss function and use the bound to explore robust models. Fur- thermore, our method can be readily applied to the existing methods that rely on the AT loss function in (4).
3. Quadratic Upper Bound for AT
Integrating Regularizers into Loss Functions
In this section, we derive a quadratic upper bound on the loss function [(fe(x + 8), v) in (4) which is commonly used in adversarial training. In the following, the function [(fo + 8), 3) is denoted as CAT and called the AT loss function. Conceivably, if there an upper bound on the AT loss function which provides a good approximation with- out losing too much of the characteristics of CAT, then the adversarial training problem in (4) or its variants might be approximately solved using the upper bound. Our bound indeed captures the key characteristics of LAT (will be dis- cussed later), and hence can be used for adversarial training.
There are many studies that seek to enhance the stability and robustness of adversarial training through regularizers in the loss function.
FGSM-GA (Andriushchenko & Flammarion, 2020) im- proves robustness by maximizing the cosine similarity, cos(V V= + 1)), where 7) is random pertur- bation, promoting consistent gradient alignment between clean and adversarial examples. Guided Adversarial Train- ing (GAT) (Sriramanan et al., 2020) introduces a relaxation term the basic loss function to find better gradient direc- tions, improving attack efficiency and overall performance. NuAT (Sriramanan et al., 2021) used a nuclear-norm reg- ularizer to optimize by leveraging joint statistics within
3

---

Quadratic Upper Bound for Boosting Robustness
3.1. Deriving the Bound
Algorithm 1 AT with Static QUB Loss
Input: network architecture f parameterized by 0, batch size B, batched training data {I,, ys 1/ i=1 training epoch
The AT loss function is nothing but the cross-entropy loss function with perturbed imput, and we begin with the def- inition of the cross-entropy loss function. Consider the classification problem with C' classes. Let 2; denote the logit corresponding to the i-th class, where i E [l,.... CJ.
T. perturbation generation method P
Output: Adversarially robust network f for = 1 to T do
for i = 1 to B do
The cross-entropy loss function is written as
= P(J, Ix, yi)
Use Equation (7) to compute LQuB
e
((2,y) = E yi log())) D: =
(5)
- 6 VoCquB
j=1 e
end for end for
where y; is the i-th element of the one-hot encoded vector y, and 5 represents the softmax probabilities of the model's output. This function is known to be convex with respect to the logit vector
Algorithm 2 AT w/ Decreasing Weight on QUB Loss
Input: network architecture f parameterized by 0, batch size B, batched training data {a;, y/ 2=1 training epoch T. perturbation generation method P
[ i = 1, ..... C) (See Appendix A).
Let us introduce the notation f which overrides the logit vector 2. We also use fo to indicate that fo represents the logit vector produced by the neural network parameterized by 0. Similarly, (z) or fz()) indicates the logit when the input is x. The cross-entropy loss function can then be writ- ten (x)()). y). However, for convenience, simplify the notation as (x)), omitting the explicit dependence on y. With this notation, the AT loss function is written as (x + 6)). The following lemma provides an upper
Output: Adversarially robust network f
for = 1 to T do
A t/T
for i = 1 to B do
= P(J, Ii, Vi)
LAT = [(f + 5).y)
Use Equation (7) to compute COUB
Luxal = (1-1e) Loun + X Lxt
)²)
bound on the AT loss function.
0 O 0 V Croaal
Lemma 1. The AT loss function is upper-bounded as fol-
end for end for
lows:
[(f(x $ ((f(x)) + -)=
3.2. Interpretation of QUB Loss
H 2
+
2 ((o++))-(()))))
We analyze each term in the QUB loss (7) and discuss how the loss can help improve the robustness against adversarial attacks. The first term, (xx)), represents the loss clean samples, reflecting the model's 's ability to handle unperturbed data. This term drives the model towards higher standard accuracy (SA), which measures the model's performance on unperturbed data.
where 5f is the gradient of the loss with respect to the logit f and [| l2 is the L2 norm of the Hessian matrix of the loss with respect the logit, evaluated at some point between f(x) and f(x 8).
The proof of this lemma uses the convexity of cross-entropy loss function (((())) with respect to fx), and the details can be found in Appendix B. This bound is quadratic with
The second term, (f(x V((()), can be approximated by applying the chain rule as
(f - ,( = 8 C((()) (8)
respect to the perturbed logit vector f(r + o), and hence, we call the bound quadratic. In order to use the bound in adversarial training, we need to specify the value |||] or its upper bound, which is given in the following lemma.
The detailed derivation is available in Appendix D. The right-hand side is the inner product between the perturbation 8 and the gradient of the loss with respect to the input. This value is small when the direction of the perturbation does not align with the direction that increases the loss the most, Consequently, minimizing the second term can potentially mitigate the adversarial impact of perturbation on the loss, thereby enhancing robustness. This is closely related to the flatness of the loss landscape: when the loss landscape is flatter (i.c., small ((=)(( small perturbations (7) have less impact on the model's performance, leading to
Lemma 2. We have H 12 < 1
The derivation of the bound is presented in Appendix C. Based on Lemmas 1 and 2, the QUB loss is defined as
CquB [(f(=))+(f(z + 6) -
1 / 111xx 8) f(
+
4

---

Quadratic Upper Bound for Boosting Robustness
greater robustness (Yu et al., 2018; Li & Spratling, 2023). The second term is the increment of loss by perturbation, and hence, minimizing the second term has the effect of flattening the loss landscape as well.
potential drawback. Due to its worst-case nature, the QUB loss tends produce gradients with larger magnitude com- pared to the original AT loss. In stochastic gradient descent (SGD), this corresponds to treating the current model as overly pessimistic and applying stronger corrective forces toward robustness. As training progresses and the model becomes sufficiently robust, continuing to rely solely on the QUB loss can lead to excessive regularization, which in turn may degrade standard accuracy. In other words, the model may overcompensate for robustness, sacrificing generalization on clean inputs.
The third term, [I + 5) - f(x) represents the change in the model's logit when perturbation is applied. Obviously, minimizing this term helps limit the impact of adversarial examples on the model's output, further strengthening ro- bustness, shown in previous works (Zhang et al., 2019; Sriramanan et al., 2021; 2020).
The second and third terms seem to have similar effect in enhancing robustness, however, using both of the terms may achieve better robustness. Specifically, for the same value of the third term, there may be various logit change vector f(x 6)- f(x aligning differently with the gradient V (z)( Hence, the second term can further enhance robustness by adjusting the vector far + 6) f(x) away from the gradient so as to prevent the increase of loss.
To mitigate this issue, we propose a training strategy in which the model is trained with the QUB loss in the initial phase, and the QUB loss is gradually transitioned to the AT loss as the training progresses. This approach, which we call QUB-decreasing, is designed to emphasize robustness in the early phase and progressively restore balance between robustness and generalization. We implement this transi- tion using a simple linear schedule with respect to training epochs, which requires no additional tuning or computa- tional overhead. This choice reflects our goal of maintain- ing training efficiency and simplicity. This AT method is detailed in Algorithm 2.
Remark. One could directly use the right hand side of (8) in order to minimize the change in loss L when per- turbation ó is applied input. However, the second term of QUB offers several advantages over the right-hand side, 8" (()(() First, as shown in (C.13), the gradient v can be computed in closed form as the difference between the softmax vector I and the one-hot vector y. without requiring additional backpropagation steps. Second, the memory usage is also saved. In contrast to the second term, which uses (z), f(x + +8), and (ff(f()))-l) all of which lie in CRC where C is the number of tlasses-the terms 5 and (=x((())) require the storage of input-sized tensors, which lie in ROx gexHxW (or Re H.W. if vectorized), where is the number of channels, His is the height, and W is the width of the input. Therefore, using the second term in QUB instead of right hand side in (8) is efficient in both computation and memory usage.
4. Experiments
4.1. Experimental Settings
We conduct experiments to compare the performance of models trained with QUB loss to existing methods adopting the traditional AT loss in (4). We use a single NVIDIA GeForce RTX 4090 GPU with 24GB of memory.
Datasets and Training Settings. To evaluate robustness in image classification, we use three datasets: 10, CIF (Krizhevsky et al., 2009), and Tiny ImageNet (Netzer et al., 2011). Following common settings in adver- sarial training, we use ResNet18 (He et al., 2016b) and WideResNett3-111 10 (Zagoruyko & Komodakis, 2016) as backbones for CIFAR-IO and CIFAR-100, and PreActRes- Net18 (He al., 2016a) for Tiny ImageNet. The optimizer is SGD (Ruder, 2016), with a learning rate of 0.1, weight decay of 5c-4, and momentum of 0.9. The batch size is set to 128. Training is conducted over 100 epochs, and we utilize a multistep learning rate scheduler that scales the learning rate by 0.1 at epochs 70 and 85.
3.3. Training Strategy
We propose a generalized training framework based on the QUB loss, as detailed in Algorithm 1. As shown in Eq. (4), we retain the original inner maximization procedure P. which corresponds to existing perturbation generation methods and is not the focus of our contribution. Since the QUB loss serves as an upper bound on the standard adver- sarial training (AT) loss, minimizing the QUB loss has the effect of reducing the AT loss. Therefore, the AT loss can be replaced with the QUB loss the original outer mini- mization problem in (4), enabling a standalone adversarial training method.
Adversarial Attack Settings. We set the attack budget to 8/255 and use step size a of 2/255 for multi-step attacks such as PGD and TRADES. Each method's hyperparam- eters are chosen based on the values recommended in the respective papers. We apply early stopping and save the model with the highest robust accuracy using PGD-10 on the validation set, following (Rice et al., 2020).
While this upper-bound property can be beneficial, partic- ularly in the early phase of training where minimizing the QUB loss can quickly improve robustness, it also introduces
5

---

Quadratic Upper Bound for Boosting Robustness
Table Test robustness (%) the CTFAR- dataset using ResNet18 architecture. Number in bold indicates the best.
Method
Step
SA
PGD10
PGD20
PGD50-10
AA
Time (h)
no AT
94.64
0.00
0.00
0.00
0.00
0.57
NuAT
82.99
51,40
50.33
49.60
47.70
1.36
GAT
81.64
54.78
53.87
53.30
47.96
1.45
TRADES
10
82.11
54.25
53,39
52.77
50.16
3,50
Free-AT
75.99
45.32
44.74
44.27
41.38
0.3
+UBB-stttic
72.98
46.72
46.19
45,89
42.82
0.56
+ +QUB-decreasin
76.10
45.58
44.89
44.35
41.60
0.56
FGSM-RS
84.32
47.28
45.60
44.66
43.34
0.86
+UUB-staie
71.13
42.96
42.19
41.54
38.48
1.16
+QUB-ddereasinn
72.90
43.85
42.96
42.52
39.31
1.16
FGSM-CKPT
90.02
41.19
38.81
37.42
37.22
1.05
+UB--ttaiic
87.63
45,41
43.78
42.54
41.53
1.35
JQUB-decreasing
88.56
43.87
41.88
40.70
39.85
1.35
FGSM-GA
82.93
49.89
48.53
47.74
45.75
3.02
QUB-static
79.75
52.24
51.33
50.82
47.33
3.27
BeB-eecreasing
81.83
50.88
49.83
49.07
46.74
3.27
FGSM-PGI(MEP)
81.48
53.43
52.47
51.75
48.41
0.89
-UB-static
80.45
53.99
53.16
52.43
48.35
1.19
QUB-decreasing
81.56
53.95
52.99
52.24
48.58
1.19
N-FGSM
81.21
49.12
48.02
47.36
45.17
0.58
QUB-static
80.76
51.19
50.24
49.60
47.00
0.70
QUB-decreasing
80.77
50.30
49.35
48.70
46.60
0.70
FGSM-UAP
81.62
53.38
52.59
51.83
47.75
1.18
QUB-static
79.70
54.25
53.51
52.77
47.76
1.49
QUB-decreasing
80.54
54.07
53.32
52.43
47.80
1.49
ELLE-A
14
47.91
46.39
45.57
43.52
0.97
QUB-static
77.60
50.20
49,44
48.86
45.51
1.21
QUB-decreasing
80.96
49.70
48.62
47.88
45.55
1.21
PGD-AT
10
81.53
52.99
52.30
51.82
48.33
2.34
+UB--staii
10
80.24
54.58
53.87
53.39
49.91
2.64
QUB-decreasing
10
82.78
53.33
52.31
51.58
49.02
2.64
Baselines. We compare the performance of widely used AT methods including Free-AT (Shafahi et al., 2019), FGSM- RS (Wong et al., 2020), FGSM-GA (Andriushchenko Flammarion, 2020), FGSM-CKPT (Kim al., 2021), FGSM-PGI (Jia et al., 2022a), N-FGSM (de Jorge Aranda al., 2022), FGSM-UAP (Pan al., 2024), ELLE-A (Ro- camora et al., 2024), and PGD-AT (Madry et al., 2018), with and without QUB loss. Methods that avoid applying cross- entropy loss directly to adversarial inputs, such as TRADES (Zhang et al., 2019), NuAT (Sriramanan et al., 2021), ) and GAT (Sriramanan et al., 2020), are also included purely for performance comparisons without QUB loss.
4.2. Impact of QUB on Accuracy
To evaluate the effectiveness of our method, we conduct extensive experiments focusing on accuracy under different adversarial conditions. Using an attack budget of e = 8/255, we assess Standard Accuracy (SA) for original images and Robust Accuracy (RA) against various attacks.
The attacks include:
PGD10 and PGD20 that perform 10 and 20 iterations of perturbation updates, respectively.
PGD50-10 (Wong al., 2020) that applies 50 iter- ations per restart over 10 restarts, generating signifi- cantly stronger perturbations.
AutoAttack (AA) (Croce & Hein, 2020a) that com-
6

---

Quadratic Upper Bound for Boosting Robustness
14
(b)
Figure 1. I Loss landscape for a specific sample: (a) model trained with FGSM-CKPT and (b) with FGSM-CKPT QUB. The left side shows colors based on the loss value, and the right side shows colors based on prediction accuracy.
bines multiple attacks-APGD-C and APGD-DLR
gradients and lead to overemphasis on robustness at the cost of clean performance.
with auto-adjusting step size (Croce & Hein, 2020a), Square Attack (Andriushchenko et al., 2020), and FAB attack (Croce& Hein, 2020b)- that provides com- prehensive evaluation of robustness.
In contrast, QUB-decreasing balances this trade-off more effectively by gradually shifting from QUB loss AT loss during training. As result, it achieves comparable or im- proved RA and better SA in many settings (see Table 1).
Table I presents the results CIFAR-10 10 using ResNet18 as the backbone architecture. Additional experimental results with different model architectures and datasets are provided in Appendix F.
In terms of training time, we observe slight increase due to the additional computation required for each term in the QUB loss. However, compared to multi-step attacks used in methods such as PGD-AT and TRADES, FAT methods with QUB loss still require comparatively less time. Therefore, QUB loss can be considered an effective auxiliary approach in FAT, as it significantly enhances performance with only modest increase in training time.
QUB-static refers to the case where the QUB loss is used throughout the entire training process following Algorithm while QUB-decreasing refers to the approach outlined in Algorithm 2, where the QUB loss is initially used in the early stages of training, gradually transitioning to AT loss as the training progresses.
4.3. Flatness of the Loss Landscape
Interestingly, we observe that combining QUB with FGSM- RS not only fails to improve robustness, but can even de- grade performance. This is because FGSM-RS, which is well known suffer from limited exploration and is highly prone to catastrophic overfitting (Kang& & Moosavi-Dezfoole 2021), often generates suboptimal or misleading adversarial examples. When QUB regularizes the loss landscape around such quwlluality perturbations, it may inadvertently enforce smoothness in non-informative or misleading regions, fur- ther harming generalization. As result, QUB may amplify the limitations of FGSM-RS rather than compensating for them.
We visualize the loss landscape on the CIFAR-10 dataset using the ResNet18 architecture
Visualization of Loss Landscape
Visualizing the cross-entropy loss landscape around the in- put can help assess a model's vulnerability to adversarial attacks. If sharp peaks exist in the loss landscape, it indi- cates that even a small perturbation can potentially mislead the model to make an incorrect classification. In contrast, a flatter landscape implies greater robustness, as successful attacks may need stronger perturbations of input (Yu et al., 2018; Li & Spratling, 2023).
Except for FGSM-RS, all baselines show an improvement in robustness when applying the QUB loss. This result verifies our discussion in Section 3.2 that the QUB loss can possibly drive the model toward the point where the change in loss is somewhat dampened in the face of perturbations or attacks.
To create 3D visualization of the loss landscape, we project clean image's 's cross-entropy loss in two directions: the gradient direction (d,) corresponding to the cross-entropy loss gradient and a random direction (d,)). We generate a 50x grid from 0 to the attack budget e (8/255) for each direction and compute the loss value at each grid point. This visualization offers insights into the sharpness or flatness of the landscape around the input, showing how resilient the model may be to adversarial perturbations (Chan et al., 2020; Dong et al., 2020; Kim et al., 2021).
Note that QUB-static achieves better RA than QUB- decreasing for most of AT methods and attacks, while SA is more compromised with QUB-static than with QUB- decreasing. In many cases-sure as with Free-AT the drop in standard accuracy outweighs the gain in robustness accuracy. This result supports our hypothesis in Section 3.3 that QUB, due its bound nature, may apply stronger
Figure 1 shows that models trained with QUB loss exhibit
7

---

Quadratic Upper Bound for Boosting Robustness
AT one 0UB Loos
2.6
QUB Loss
2.4
Sparse Aa d (000
2.2
1.23
1.28
5.06
1.8
0.0
0.33
2/83
4:400.7
1.6
POSMASI
rostag
FOSM- usp
Potse
14
1.2
Figure 2. Average dominant eigenvalue for each method. Models trained with QUB loss show smaller dominant eigenvalues.
12
16
1/255)
Figure 3. Comparing FGSM-CKPT (blue line) and FGSM-CKPT QUB (orange line) for each attack budget shows that the sparsity value with QUB is consistently higher in all ranges.
a significantly flatter loss landscape. As mentioned above, this flatter landscape indicates that the model can make ac- curate predictions across a broader region around each input sample. Consequently, the model's 's robustness is enhanced, as it becomes less sensitive to small perturbations around the input. This result demonstrates that our QUB loss effec- tively strengthens robustness and more importantly, trains the model to remain robust against unseen attacks.
AT Loo
QLB Loos
16 16
16
15
Sparkly On 0000
32
Dominant Eigenvalue of Hessian Matrix
While the visualization verifies the flatness of loss landscape around a single sample, it gives only limited view of land- scape over the entire dataset. To further assess the flatness of the loss landscape, we examine the dominant eigenvalue of the Hessian matrix of the cross-entropy loss with respect to the input. The eigenvalue of the Hessian matrix reflects the curvature along specific directions; a larger eigenvalue suggests steeper curvature along the corresponding eigen- vector. By focusing on the dominant (largest) eigenvalue, we can capture the overall sharpness or flatness of the loss landscape. A smaller dominant eigenvalue indicates a flat- ter landscape, which is typically associated with greater robustness.
Free
POBM-207
Food de
Figure 4. Sparsity values with and without QUB for each method. Using QUB consistently results in higher values across all methods.
defend not only against the perturbations used in training but also against potential attacks that unseen in training, suggesting robustness against broader adversarial scenarios.
4.4. Adversarial Sparsity
In this experiment, we extract 1,000 samples from the CIFAR-10 test dataset and calculate the dominant eigen- value of the Hessian matrix of the cross-entropy loss with respect to each sample. We then compute the average of these dominant eigenvalues to compare the flatness of the loss landscape across different training methods.
Several studies suggest that RA alone cannot fully capture the robustness of model, it focuses solely whether an attack point is defended. The sparsity metric (Olivier & Raj, 2023) addresses this by measuring the average distance to the nearest attackable point within Lox ball, with a larger value indicating greater robustness. The experiments are conducted in the same environment as in Section 4.3, and we vary the attack budget across [4/255, 8/255, 12/255, 16/255] as opposed to the training with fixed of 8/255.
As shown in Figure 2, the use of QUB loss results in gener- ally smaller eigenvalues across the dataset. This indicates that the loss landscape is not only flattened for specific samples as shown in Figure 1, but also exhibits enhanced robustness across the entire dataset. This experiment em- pirically supports the claim made in Section 3.2 that the second term in QUB loss contributes to flattening the loss landscape. Moreover, the upper bound loss helps the model
As shown in Figure 3, applying QUB loss during training on PGSM-CKPT results in better performance in terms of the density metric of attackable points compared to training with AT loss on FGSM-CKPP Figure 4 illustrates the sparsity of
8

---

Quadratic Upper Bound for Boosting Robustness
each AT method measured four different values of epsilon. In all the methods, the sparsity values consistently larger for every attack budget, indicating that the QUB loss helps reduce the number of attackable points.
Wiley, 1975.
Bertsekas, D. P. and Tsitsiklis, J. N. Parallel and Distributed Computation: Numerical Methods. Athena Scientific, 1997. ISBN 1886529019.
5. Conclusion
Chan, A., Tay, Y., Ong, Y. S., and Fu, J. Jacobian adversari- ally regularized networks for robustness. In International Conference on Learning Representations, 2020.
In this paper, we presented a novel FAT method for enhanc- ing the robustness of a model against adversarial attacks. Our method aims to drive the model toward minimizing quadratic upper bound on the cross-entropy loss function, instead of the conventional AT loss function. Our method can be applied to many existing FAT methods that are based on the conventional AT loss function. We showed through extensive experiments that the robustness of existing FAT methods can be further enhanced with the QUB loss. Var- ious metrics such eigenvalues and sparsity demonstrate that the QUB loss has the effect of flattening the loss land- scape, which contributes to enhanced robustness.
Croce, and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free at- tacks. In International Conference on Machine Learning, pp. 2006-2216666 2216. PMLR, 2020a.
Croce, F. and Hein, M. Minimally distorted adversarial examples with a fast adaptive boundary attack. In Interna- tional Conference on Machine Learning, pp. 2196-2205. PMLR, 2020b.
de Jorge Aranda, P., Bibi, A., Volpi, R., Sanyal, A., Torr, P., Rogez, G., and Dokania, P. Make some noise: Reliable and efficient single-step adversarial training, Advances in Neural Information Processing Systems, 35:12881- 12893, 2022.
Acknowledgments
This work was supported by the National Research Foundation of Korea(NRF) grant funded by the Korea governmen(MSSIT)RSS- 200-S//T/7RR-222220555557557 This paper was written as part of Konkuk University's 's research support program for its faculty on sabbatical leave in 2024.
Dong, Y., Deng, Z., Pang, T., Zhu, J., and Su, H. Ad- versarial distributional training for robust deep learning. Advances in Neural Information Processing Systems, 33: 8270-8283, 2020.
Impact Statement
Golgooni, Z., Saberi, M., Eskandar, M., and Rohban, M. H. Zerograd: Costless conscious remedies for catastrophic overfitting in the fgsm adversarial training. Intelligent Systems with Applications, 19:200258, 2023.
We develop a novel adversarial training method enhance the robustness of machine learning models against adversar- ial attacks by incorporating a new loss function into exist- ing training approaches. As a result, the proposed method significantly improves the resilience of models, making them more reliable in real-world applications, especially in critical areas such as autonomous systems, healthcare and finance. This advancement is important because it helps secure AI systems against potential malicious attacks, fos- tering greater trust in Al technologies and ensuring their safe, ethical deployment in high-stakes environments.
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
Hazan, E. Lecture notes: Optimization for machine learning.
arXiv preprint arXiv: |rXi:::909.00:: 1909.03550, 2019.
He, K., Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 1-14, 2016, Proceedings, Part IV 14, pp. 630- 645. Springer, 2016a.
References
Andriushchenko, M. and Flammarion, N. Understanding and improving fast adversarial training. Advances in Neu- ral Information Processing Systems, 33:16048-16059 2020.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learn ing for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2016b.
Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. Square attack: a query-efficient black-box adversarial attack via random search. In European conference on computer vision, pp. 484-501. Springer, 2020.
pp. 20166.
Horn, R. A. and Johnson, C. R. Matrix analysis, pp. 176- 180. Cambridge University Press, Cambridge, 1985. ISBN 0-511-81081-4.
Apostol, T. M. Calculus. vol. pp. 273-274. New York:

---

Quadratic Upper Bound for Boosting Robustness
Huang, Z.,, Fan, Y., Liu, C., Zhang, W., Zhang. Y., Salzmann, M., Süsstrunk, S., and Wang, J. Fast adversarial training with adaptive step size. IEEE Transactions on Image Processing, 2023.
Lin, R., Yu, C., Han, B., Su, H., and Liu, T. Layer-aware analysis of catastrophic overfitting: Revealing the pseudo- robust shorteut dependency. In Forty-first International Conference on Machine Learning, 2024c.
Jia, X., Zhang, Y., Wei, X., Wu, B., Ma, K., Wang. J., and Cao, X. Prior-guided adversarial initialization for fast adversarial training. In European Conference on Computer Vision, pp. 567-584. Springer, 2022a.
Madry, A., Makelov, A., Schmidt, L.,, Tsipras, D., and
Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018
Jia, X., Zhang, Y., Wu, B., Wang, J., and Cao, X. Boost- ing fast adversarial training with learnable adversarial initialization. IEEE Transactions on Image Processing, 31:4417-4430, 2022b.
Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A. Y., et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, pp. 4. Granada, 2011.
Jia, X., Chen, Y., Mao, X., Duan, R., Gu, J., Zhang, R., Xue, H., Liu, Y., and Cao, X. Revisiting and exploring efficient fast adversarial training via law: Lipschitz regu- larization and auto weight averaging. IEEE Transactions on Information Forensics and Security, 2024a.
Olivier, R. and Raj. B. How many perturbations break this model? evaluating robustness beyond adversarial accu- racy. In International Conference on Machine Learning, pp. 26583-26598, PMLR, 2023.
Jia, X., Zhang, Y., Wei, X., Wu, B., Ma, K., Wang, J., and Cao, X. Improving fast adversarial training with prior-guided knowledge. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024b.
Pan, C., Li, Q., and Yao, X. Adversarial initialization with universal adversarial perturbation: A new approach to fast adversarial training. In Proceedings of the AAAI Con- ference on Artificial Intelligence, volume 38, pp. 21501- 21509, 2024.
Kang, P. and Moosavi-Dezfooli, S.-M. Understanding catas- trophic overfitting in adversarial training, 2021.
Park, G. and Lee, W. Reliably fast adversarial training via latent adversarial perturbation. In Proceedings of the IEEF/CVE International Conference on Computer Vision pp. 7758-7767, 2021.
Kim, H., Lee, W., and Lee, J. Understanding catastrophic overfitting in single-step adversarial training. In Proceed- ings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 8119 8127,, 2021.
Rice, L., Wong, E.,, and Kolter, Z. Overfitting in adversar- ially robust deep learning. In Proceedings of the 37th International Conference on Machine Learning, pp. 8093- 8104. PMLR, 2020.
Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009.
Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial machine learning scale. In International Conference on Learning Representations, 2017.
Rocamora, E. A., Liu, F., Chrysos, G., Olmos, P. M., and Cevher, V. Efficient local linearity regularization to over- come catastrophic overfitting. In The Twelfth Interna- tional Conference on Learning Representations, 2024.
Li, L. and Spratling, M. Understanding and combating robust overfitting via input loss landscape analysis and regularization. Pattern Recognition, 136:109229 2023.
Ruder, S. An overview of gradient descent optimization algorithms. arXiv preprint (09.0//40000474// 2016.
Li, T., Wu, Y., Chen, S., Fang, K., and Huang, X. Subspace adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13409-13418, 2022.
Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z.., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019.
Lin, R., Yu, C., Han, B., and Liu, T. On the over- memorization during natural, robust and catastrophic overfitting. In The Twelfth International Conference on Learning Representations, 2024a.
Sriramanan, G., Addepalii, S., Baburaj. A., et al. Guided adversarial attack for evaluating and enhancing adversar- ial defenses. Advances in Neural Information Processing Systems, 33:20297-20308, 2020.
Lin, R., Yu, C., Han, B., and Liu, T. On the over- memorization during natural, robust and catastrophic overfitting. In The Tweifth International Conference on Learning Representations, 2024b.
Sriramanan, G., Addepalli, S., Baburaj. A., et al. Towards efficient and effective adversarial training. Advances in Neural Information Processing Systems, 34:11821 1 11833, 2021.
10

---

Tramèr, E, Kurakin, A., Papernot, N., Goodfellow, I. Boneh, D., and McDaniel, P. Ensemble adversarial train- ing: Attacks and defenses. In International Conference on Learning Representations, 2018.
Vivek, B. and Babu, V. Single-step adversarial train- ing with dropout scheduling. In Proceedings the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 947-956. IEEE, 2020.
Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Im- proving adversarial robustness requires revisiting misclas- sified examples. In International conference on learning representations, 2019.
Wong, E., Rice, L., and Kolter, J. Z. Fast better than free: Revisiting adversarial training. In International Conference Learning Representations, 2020.
Yu, F., Liu, C., Wang, Y., Zhao, L., and Chen, X. Interpret- ing adversarial robustness: view from decision surface in input space. arXiv preprint 1xiv:18100000144 2018.
Zagoruyko, S. and Komodakis, N. Wide residual networks. In Richard C. Wilson, E. R. H. and Smith, W. A. (eds.), Proceedings of the British Machine Vision Conference (BMVC), pp. 87.1-87.12. BMVA Press, September 2016. ISBN 1-901725-59-6. doi: 10.5244/C.30.87.
Zhang, H., Yu, Y., Jiao, J., Xing. E., Ghaoui, L., and Jordan, M. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019.
Zhao, M., Zhang, L., Kong. Y.. and Yin, Fast adversarial training with smooth convergence. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4720-4729, 2023.

---

Quadratic Upper Bound for Boosting Robustness
A. Proof of convexity of loss function
Although the convexity cross-entropy loss function with respect to the logit is known in the literature, we present the proof for the completeness of the paper. function g convex it satisfies the following inequality for any two vectors and in the domain of g:
(\a + (1- - X)b) - >g(a) + - \)g(b), YA E [0.
(A.1)
We will use this definition to prove the convexity of the loss function with respect the logit. The cross-entropy loss is a nonnegative linear combination of functions of the following form:
g(z) = -log
(A.2)
Σk=1
e
where is the i-th element of the logit vector, and C' is the number of classes. Since nonnegative combination of convex functions is convex, it suffices to prove the convexity of g(z). The function g(z) is written as:
g(2) = -4 + log
Σ
e
(A.3)
Since the linear function is convex, we just need to prove the convexity of the second term. We invoke Hölder's inequality for the proof.
Consider p, q E [1, oo] such that + 1 1. Hölder's inequality states that:
Σ uuys S
|ull
Σ
1
(A.4)
for any two vectors = (w1,... Un)) and v (01,... Un) of real numbers. To apply this inequality, let = e and = (1)b),, where a; 's and b, 's are arbitrary real numbers and À is constant that lies within the interval (0, 1). Choose p x and x-x. which satisfies I + = 1. Hölder's inequality gives:
C
C
1-2
Σ
das (1 (1-1
N]6e <
Σ m0
Σ
b
(A.5)
i=
Taking the logarithm on both sides yields:
C
log
Σ da (1-
S A log
Σ
+1 - A)
Σ cl
(A.6)
This implies that the second term in (A.3) is convex, and consequently, g(z) is convex. This completes the proof.
B. Proof of Lemma 1
We derive quadratic upper bound for convex functions using the two well-known facts in the following.
Lemma 3 (Taylor's Theorem, (Apostol, 1975)). For any twice continuouly differentiable function g.
1
g(v) g(x) + Vg(x) - x)) + 2 - [V)=))('((=)) -x)))) -x), Vx,
(B.
where z is some vector between x and y (i.e., 2 = az + (1 - a:yy for some a E [o, 1]).
Note that V2g(2) denotes the Hessian of g. which represents the matrix of second-orde order partial derivatives of the function evaluated the point: 2. This Hessian matrix is denoted as H in the following sections.
12

---

Quadratic Upper Bound for Boosting Robustness
Lemma 4 ((Horn & Johnson, 1985)). For symmetric matrix A,
o Av S Amax (A) ||0||
(B.2)
where Amax (A) is the largest eigenvalue of A.
By utilizing the symmetry of the Hessian matrix, and applying inequality (B.2) to equation (B.1), we derive the following inequality:
g(v) S g()) Vg(()" 2) + Amax H
bly x²|2.
(B.3)
For convex function y, its Hessian H is always positive semidefinite and hence, the eigenvalues of H are all nonnegative. Furthermore, the largest eigenvalue of H can be computed follows:
H 2
max
H
(B.4)
||-||==1
max
HT
(B.5)
||u||==1
max VUTH2r ||
(:: H. is symmetric)
(B.6)
Amax H
(B.7)
V (H)
(B.8)
Amax (H). (: g convex H 0)
(B.9)
Therefore, we have the following quadratic upper bound on the convex function g:
H 12 lly x11-
g(v) S g(x) Vg(=)"(y- 2)
(B.10)
2
This together with the convexity of [()()) with respect to the logic f(x) (Appendix A) yields
[( + 0)) < ((f(x)) + (f(xr + 6) - [(x)) ((((())
H 2 1f(x+ f())l
(B.11)
2
where H is the Hessian of the loss with respect to logits, evaluated at some point between f(x) and f(z + 8). i... H = V}((f) with af(x) + (1- (1-a)f(zz + 6) for some E [0, 1]. This completes the proof.
Remark. An alternative derivation of the QUB loss can be made using the notion of 3-smoothness, a standard tool in optimization theory. In particular, one may derive the bound by first assuming that the cross-entropy loss has a Hessian with bounded nn-m and then applying the lemma that such condition implies 3-Lipschitz continuity of the gradient. This yields the same upper bound as in (B.1), and offers a more succinct interpretation (see, e.g., (Hazan, 2019)). We chose to present the derivation via Taylor's theorem to explicitly connect the upper bound to the local behavior of the loss landscape.
C. Proof of Lemma 2
Derivative of Softmax function
For the convenience of the notation, we will use z to represent the logits instead of fxx) The probability of each class after applying the softmax function is given by:
01
(C.1)
1== e
where 2; is the i-th value of the logit vector 2. The derivative of 9 with respect to the logit 2, is written as follows. When the indices are the same (i.e., = nt)
0
11=1 e -0
e
Σ e - -
51(( (1-9)).
(C.2)
0z;
E E/= e²1 )²
Σド=
C
e²)
Σラ= E²
13

---

Quadratic Upper Bound for Boosting Robustness
When the indices different (i.e., + n))
0 efieet
--idnn.
(C.3)
2m.
Σ 1= es,) )²
Combining both cases, have
Oj:
Wi(1 - (i);
ifi=n n if n
(C.4)
O2n
Derivative of Cross-Entropy Loss
Let yi be the i-th element of the one-hot encoding vector where = 1 for the correct class and y/s = 0 otherwise. The cross-entropy loss function is defined as
C Σ i=1
((2)
yi log((s).
(C.5)
Now, the derivative of the loss with respect to is
OC(2)
8 (og((s))
y/
(C.6)
Ozn
Ozn
1=1
① Olog(ús) Dii
y/
(C.7)
Oi
Izn
1=1
Vi Oü:
(C.8)
Di Ozn
Vn
Vi
Un (1 (nn) +
(C.9)
In
Us
-- + Unan + Σ U:On
(C.10)
-Mn + Σ yeun
(C.11)
Un In-
(C.12)
Thus, we have
0c(z)
0L(z)
+ In.
and
Oz y + ÿ.
(C.13)
Ozn
Therefore, the derivative of the loss with respect to the logits is simply the difference between the softmax vector and the one-hot encoded vector
Second Derivative (Hessian)
The second derivative of the loss computed as follows:
(L)(z)
0(-y 9)
0g
(C.14)
0=2
0z
14

---

Quadratic Upper Bound for Boosting Robustness
Since y is one-hot encoded vector, it does not depend the logits and is treated constant. Therefore, we focus the derivative of with respect The Hessian matrix is given by:
1/1
v
U1
1/2//11
f/2
0/2
V20n
H
(C.15)
Un
-in
On. 1
equivalently:
= U:Ds i
Hij
(C.16)
Calculating the L2 norm of the matrix is computationally expensive. Instead, we the following upper bound for approximation (Bertsekas & Tsitsiklis, 1997):
|
(C.17)
where ||H]| and ||]]| are the L1 and Loo norms of the Hessian matrix, representing the maximum absolute column sum and row sum, respectively. Using the properties of the softmax vector, where 0 < Dt < 1 and E, D: 1, we can calculate the L norm of the Hessian matrix:
HII1 = max
Hig
(C.18)
157sm
1=1
max 15)5m
Σ Úy0s + 03 20} i=1
(C.19)
max
(20 20² )
(C.20)
15$5m
The maximum value of this expression occurs when Új 3. yielding 1.2 Since the Hessian matrix is symmetric, its Loo norm is also J. Therefore, we have:
1 1
(C.21)
4
This completes the proof.
D. Expressing the Second Term Using Chain Rule
In this section, we further discuss the interpretation of the second term of the QUB loss. Recall that fo(x) represents the logit vector of a neural network model parameterized by 0, when the input is x. For convenience, we denote it as / /(x). For a sufficiently small 8, the Taylor expansion of f(x + 5) around x is given by
f 8) = f(z) + (z)(
(D.1)
where (z) is the Jacobian matrix the logit with respect to the input æ. It lies in (=-WW-))) where C is the number of classes, the number of channels, H is the height, and W the width of the input. As the notation indicates, we assume that the input vector z or perturbation d vectorized appropriately.
Using the above approximation, substitute it into the second term of QUB loss, (()
(f(++ (V.
(D.2)
= -VV
(D.3)
By the chain rule, the gradient of L(f(x)) with respect to can be written as
v=((f(z)) (./o"v")))
(D.4)
15

---

Quadratic Upper Bound for Boosting Robustness
follows that
8 /
(D.5)
We thus have
- -()++ vV
(D.6)
This completes the derivation, showing that the expression (f(a 8) - 5t V vx((())) for small
can be approximated by
E. Performance Comparison of QUB Loss with Respect to Perturbation Budget
The QUB is derived by applying Taylor's Theorem around f()) with perturbation ö on æ. and hence, the bound is effective (i.e., captures the core characteristics of AT loss) when the perturbation 5 is small. We conduct experiments verify how the QUB loss affects performance across various ranges of attacks, including FGSM-RS, N-FGSM, and PGD-AT. These experiments are performed on the CIFAR-10 10 dataset using the ResNet-18 architecture.
The training and evaluation are conducted using four different values of e: [4/255, 8/255, 12/255, 16/255). The rest of the experimental setup is the same as the one used in Section 4.
Table Comparison SA and AA performance under different perturbation budgets for each epsilon. Bold numbers indicate best result within each attack method (i.e., FGSM-RS, N- N-FGSM, and PGD-AT).
Perturbation (/255)
4.0
8.0
12.0
16.0
Method
SA
AA
SA
AA
SA
AA
SA
AA
FGSM-RS
89.46
67.42
84.32
43.34
81.48
25.79
81.21
12.94
QUBB-ttaic
87.92
68.52
71.13
38.48
78.11
29.68
76.21
17.06
DUBBdecccasing
88.47
67.74
72.90
39.31
49.22
22.66
39.46
17.15
N-FGSM
89.32
66.64
82.57
48.98
74.18
39.45
65.43
34.97
+ QUB-static
87.66
69.33
78.96
51.32
73.84
41.34
62.86
35.84
-eu-recca
88.42
68.43
80.92
50.69
72.16
40.42
64.39
35.92
PGD-AT
89.04
68.03
81.19
48.35
73.35
34.81
67.69
24.48
+ QUB-static
87.90
70.09
80.58
50.07
72.71
36.16
67.38
25.18
QUB-decress
88.24
69.32
82.78
49.47
72.57
35.89
69.60
25.20
Table 2 presents the results for clean image classification performance (SA) and robustness (AA) across various values of the budget c on the perturbation 5. To effectively illustrate the changes in values, Figure 5 depicts how the performance metrics evolve relative the PGD-AT and N-FGSM baselines using AT loss.
During training, when AT loss is replaced with QUB loss, both the standard version (+QUB-static) and its variant with increasing perturbations (+QUB -eo--decra))ing exhibit gradual decline in robustness as the magnitude of perturbation increases. This is somewhat natural in that the gap between the upper bound and the AT loss increases as the perturbation increases. The QUB loss should thus be used with careful consideration of the attack environment. Nonetheless, this result shows that the QUB can be used to enhance the robustness against some range of attacks. This trend generally observed in both PGD and N-FGSM, while FGSM-RS does not follow this pattern due catastrophic overfitting, which distorts the relationship between perturbation size and robustness.
16

---

Quadratic Upper Bound for Boosting Robustness
+QUi2ddecneccgg
+0U0
iuprevement oTAA
10-
1.
10 c//25)
(255)
(a)
(b)
Figure Accuracy improvement from applying QUB adversarial training using (a) PGD-AT and (b) N-FGSM. While QUB (UB-decrcasing shows smaller AA gains compared to QUB-static, better preserves standard accuracy. As the perturbation strength increases, the improvement gradually diminishes, reflecting characteristics QUB.
17

---

Quadratic Upper Bound for Boosting Robustness
F. Experiments Results
To verify the effectiveness our method across various datasets and models, we conduct the experiments presented below (Tables 5, and 6). For CIFAR100 and Tiny ImageNet datasets, we include only QUB-decreaiing as QUB-static exhibits excessively deteriorated standard accuracy for those datasets. In all the experiments, we observe that the robustness of many existing AT methods can be enhanced by our QUB loss.
E.I. CIFARIO, WRN34-10
Table Test robustness (%) on CIFAR-I0 dataset using WRN34-10 architecture. Numbers bold indicate the best.
Method
Step
SA
PGD10
PGD20
PGD50-10
AA
Time (h)
Natural Training
95.07
0.00
0.00
0.00
0.00
2.67
NuAT
85.16
53.96
52.74
51.81
49.90
9.37
GAT
83.44
56.17
55.39
55.00
50.65
9.85
TRADES
10
84.97
55.38
54.59
54.22
51.86
40.45
Free-AT
80.05
42.64
41.80
41.25
39.85
2.15
QUB-static
76.42
47.06
46.51
46.08
43.59
4.29
QUB-decreasing
78.83
45.53
44.59
44.07
41.97
4.29
FGSM-RS
87.05
48.70
46.93
46.03
45.18
5,02
+UB--ttaic
80.89
50.64
49.70
49.09
46.65
7.45
+UBB -ecB-eecgg
69.65
40.62
39.88
39.43
36.78
7.45
FGSM-CKPT
91.45
43.87
41.31
40.10
39.49
8.68
+UUB-static
87.63
48.14
46.66
45,80
44.18
11.23
(QUB-decreasipg
91.01
46.03
43.55
42.49
42.26
11.23
FGSM-GA
85.03
52.15
50.81
49.88
48.27
20.82
+QUB-staiee
82.86
54.27
53.59
52.76
50.32
22.42
85.05
53.47
52.35
51.66
49.74
22.42
N-FGSM
84.26
50.01
48.67
47.98
46.64
3.44
QUB-static
85.39
53.39
52.12
51.36
49.91
5.04
BeUB-decraasing
82.66
51.31
51.29
50.66
48.86
5.04
FGSM-PGI(MEP)
80.36
52.84
52.33
51.68
48.59
5.89
QUB-static
84.66
54.26
53.23
52.33
49.14
8.32
-UU--decraasing
84.31
55.28
54.08
53.37
50.10
8.32
ELLE-A
80.78
46.95
45.80
45.20
43.16
8.49
-UBB-ttaic
78.97
49.93
48.86
48.42
46.92
10.04
QUU-decreasing
81.00
47.97
46.71
46.10
44.14
10.04
FGSM-UAP
84.73
53.93
52.64
51.44
48.84
7.49
-UB--staiic
84.47
54.46
53.42
52.68
49.72
9.92
-QUB-decreasing
84.54
54.31
53.12
52.29
49.52
9.92
PGD AT
10
84.88
53.99
52.98
52.46
49.80
24.24
QUB-static
10
82.66
56.14
55,47
54.99
51.49
26.63
-UB-deccegsing
10
85.21
55.12
54.17
53.66
50.86
26.63
18

---

Quadratic Upper Bound for Boosting Robustness
F.2. CIFAR100, ResNet18
Table Test robustness (%) on CIFAR-100 dataset using R architecture. Numbers in bold indicate best.
Method
Step
SA
PGD10
PGD20
PGD50-10
AA
Time (h)
Natural Training
76.92
0.02
0.02
0.00
0.00
0.92
NuAT
54.90
25.50
22.14
19.44
18.79
3,01
GAT
59.92
28.37
27.76
27.09
22.87
2.81
TRADES
10
57.69
30.22
29.78
29.15
25.06
7.17
Free-AT
48.42
23.27
22.85
22.56
19.03
0.30
QUB-decreasing
44.36
23.85
23.61
23.49
19.71
0.56
FGSM-RS
45.39
19.98
19.41
18.87
15.93
1.16
QUB-decreasing
33.57
19.86
18.62
18.48
15.16
1.60
FGSM-CKPT
69.79
12.68
9.55
7.39
5.71
1.34
QUUB-decrasiin
63.16
24.97
23.96
23.27
21.54
2.16
FGSM-GA
56.38
28.37
27.55
26.98
23.43
3.03
+UB-ddccreasing
51.11
29.09
29.46
29.12
25.11
3.28
N-FGSM
55.40
27.18
26.69
26.25
23.36
1.21
QUB--eereasiin
51.99
30.46
30.14
29.78
25.82
1.97
FGSM-PGI(MEP)
55.69
29.21
28.55
28.23
24.48
2.83
QUB-decreasing
53.68
29.78
29.20
28.77
24.92
3.46
ELLE-A
54.36
25.53
24.80
23.92
21.03
1.15
deB-eecca
52.13
27.39
26.81
26.39
22.93
1.30
FGSM-UAP
56.57
28.83
28.23
27.66
24.39
3.70
+UB-ddccreaiigg
55.01
29.28
29.13
28.76
25.15
4.25
PGD AT
10
55.52
29.14
28.85
28.38
24.22
5.66
+UB--dccreaiin
10
53.49
29.98
29.61
29.25
25.40
6.29
19

---

Quadratic Upper Bound for Boosting Robustness
F33. CIEARI00, WRN34-10
Table Test robustness (%) on CIFAR-100 dataset using WRN34-10 architecture. Numbers in bold indicate best.
Method
Step
SA
PGD10
PGD20
PGD50-10
AA
Time (h)
Natural Training
78.89
0.04
0.01
0.00
0.00
4.9
NuAT
49.43
20.45
18.44
16,41
16.94
9.53
GAT
65.71
25.92
25.05
24.32
22.44
9.93
TRADES
10
61.14
31.55
31.16
30.62
27.17
40.54
Free-AT
48.74
21.82
21.38
21.00
18.45
2.15
QUB-decreasing
44.13
24.70
24.40
23.92
21.01
4.28
FGSM-RS
62.48
26.80
25.46
24.70
23.25
5.97
QUB-decreasing
38.24
19.54
19.42
19.26
15.86
7.44
FGSM-CKPT
60.66
8.89
7.25
5,31
3.16
8.21
QUUB-decrasiin
51.82
18.95
18.02
17.40
15.79
11.26
FGSM-GA
60.44
27.48
26.45
25.78
23.92
20.70
+UB--dccreasing
53.60
30.16
29.64
29.13
25.85
23.87
N-FGSM
58.85
29.08
28.36
27.84
25.34
3.48
QUB--eereaaiing
53.10
30.88
30.49
30.15
26.41
5.04
FGSM-PGI(MEP)
61.95
30.30
29.26
28.20
25.80
5.86
QUB-decreasing
59.22
30.38
29.43
28.77
26.20
8.29
ELLE-A
55.24
29.63
29.71
29.28
22.92
8.50
deB-eecra
54.02
26.43
26.12
25.48
18.64
9.96
FGSM-UAP
61.00
29.49
28.55
27.68
24.87
7.52
QUB-ddccreaiigg
59.19
29.97
29.39
28.85
26.03
9.91
PGD AT
10
58.56
29.95
29.37
28.98
25.70
24.20
+UB--decresiin
10
52.98
31.41
31.11
30.85
27.20
26.63
20

---

Quadratic Upper Bound for Boosting Robustness
F.4. Tiny ImageNet, PreActResNet188
Table Test robustness (%) on the Tiay ImageNet dataset using PreActResNet18 architecture. Numbers bold indicate the best.
Method
Step
SA
PGD10
PGD20
PGD50-10
AA
Time (h)
Natural Training
63.27
0.01
0.01
0.00
0.00
2.06
NuAT
53.97
18.25
17.52
17.06
13.50
5.72
GAT
1
49.75
17.71
17.30
16.93
12.62
6.11
TRADES
10
46.70
21.76
21.56
21.38
16.33
16.55
Free-AT
36.32
16.22
16.04
15.91
12.03
1.29
QUB-decreasing
31.34
16.59
16.47
16.38
12.51
2.52
FGSM-RS
48.14
20.54
19.98
19.67
16.39
3,39
-UB--dcreasing
29.47
16.02
15.89
15.77
11.73
5.10
FGSM-CKPT
57.93
11.68
10.49
9.89
9.07
4.16
+QUB-dccreasing
52.11
19.13
18.33
17.83
15.19
5.59
FGSM-GA
44.98
21.25
20.75
20.52
16.46
18.73
+QUB-decreasing
38.39
21.87
21.57
21.33
17.21
19.95
N-FGSM
44.96
21.20
20.80
20.52
16.70
2.66
+QUB-decreasing
41.97
21.67
21.31
21.10
17.18
3.79
FGSM-PGI(MEP)
42.72
23.63
23.35
23.07
17.58
5.51
OUB-decreasing
43.32
23.79
23.40
23.38
18.03
7.02
ELLE-A
43.95
17.62
16.91
16.34
13.42
5.98
QUB-decreasing
41.97
21.67
21.31
21.10
17.18
6.96
FGSM-UAP
46.25
21.86
21.53
21.36
17.26
4.88
QUB-decreasing
42.45
22.49
22.20
21.94
17.71
6.28
PGD AT
10
43.15
21.93
21.67
21.44
17.44
11.29
-UB-decreasing
10
41.00
22.94
22.75
22.61
18.38
13.16
21


Reviews:
[{"review_id": "HKA0HwQx6H", "reviewer": "Reviewer_YDCX", "summary": "This paper provides a new theoretical upper bound of the adversarial training loss and proposes a method to improve the existing fast adversarial training. Specifically, the paper focuses on the problem of catastrophic overfitting, or the degraded robustness after fast adversarial training. To overcome this problem, the paper derives a new upper bound of adversarial training loss, called Quadratic Upper Bound (QUB), and proposes a new adversarial training that minimizes the QUB loss rather than traditional adversarial training losses. The derivation of QUB uses the convexity of the cross entropy loss function, which is commonly used in practice, and additional bounding of Hessian. The paper proposes a new loss term, i.e., QUB loss, and a new training strategy that uses QUB loss with traditional adversarial training loss (or AT loss). A set of experiments demonstrates the effectiveness of the training with QUB loss and the effect of QUB losses in flattening loss landscape and better adversarial sparsity.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### 1. On the practical tightness and overestimation behavior of the QUB loss\nWe appreciate the reviewer’s emphasis on the importance of validating QUB as a practical upper bound. To evaluate the practical tightness of the proposed QUB loss, we compared QUB and AT loss during training. For most experiments, the QUB loss consistently decreases in parallel with the AT loss while maintaining a small and nearly constant gap. Specifically, for each image, the mean difference between the QUB loss and the AT loss during training is approximately 0.0013, calculated as the average of epoch-wise mean differences. This suggests that the upper bound is fairly tight in practice without significant overestimation.\nNotably, with FGSM-PGI, the gap remains stable throughout training, confirming the reliability of QUB as a practical upper bound. However, in settings prone to overfitting—such as standard FGSM—QUB initially tracks the AT loss closely but begins to overestimate after catastrophic overfitting occurred. In these cases, the QUB loss value becomes 2–3 times larger than the AT loss, limiting its effectiveness as an upper bound in the later stage of training.\nExcept for such extreme cases, we found that QUB reliably serves as a practical surrogate loss that balances efficiency and robustness across various FAT settings.\n\n### 2. On performance limitations and the potential for dynamic QUB-AT combinations\nWe applied QUB in two forms: (1) using QUB loss alone throughout the training process (QUB-static), and (2) gradually transitioning from QUB loss to AT loss during training (QUB-decreasing). We adopt such simple applications of QUB in order to demonstrate the applicability with minimal computational demand.\nHowever, we acknowledge that such a static form of method can be suboptimal for fine-grained performance tuning. As a result, in some experiments, QUB-based models perform comparably to or even slightly worse than the baselines.\nWe find the reviewer’s suggestion of dynamically combining QUB and AT loss (e.g., via fixed or adaptive weighting schemes) to be a promising direction. In particular, tuning the balance based on attack characteristics or training stage may allow QUB to better complement different adversarial settings.\nAlthough our method may not reach SOTA-level robustness in its current form, it demonstrates the potential of QUB as a lightweight regularizer that enhances training stability and robustness when integrated into various adversarial training pipelines.\n\n### 3. On the limitation of using only ResNet-based architectures\nWe acknowledge that all models used in our experiments are ResNet variants. This choice was made to align with existing literature and ensure a consistent and fair comparison with prior FAT methods adopting ResNets.\nHowever, we agree that evaluating the generalization of QUB on recent architectures such as Vision Transformers or ConvNeXt is essential for understanding its broader applicability. We plan to conduct experiments with those architectures, however we have not been able to obtain the results as of this rebuttal, primarily due to computational constraints.\nGiven that QUB is a loss-level modification that does not rely on architectural assumptions, we expect it to be easily adaptable to a wide range of models, and we will include these additional results accordingly as soon as the experiments are finished.", "claims_and_evidence": "Proofs support the theoretical statements, and the experiments demonstrate the effectiveness of the proposed methods.", "methods_and_evaluation_criteria": "The models used for evaluation are all ResNet variants, and more evaluations on recent model architecture would be needed.", "theoretical_claims": "I briefly checked the proofs, and I don’t find any specific issue in the proof part.", "experimental_designs_or_analyses": "The presented experiments are well-designed, and the analyses look correct.", "relation_to_broader_scientific_literature": "The paper presents interesting tricks to upper-bound the adversarial training loss. Although the tricks are limited to the context in which we use cross-entropy loss and a softmax layer, this context is extremely common in ML practice.", "essential_references_not_discussed": "The paper cited the needed references well.", "other_strengths_and_weaknesses": "### Strengths\n1. To the best of my knowledge, the paper’s findings are novel contributions.\n2. The paper presents useful tricks for theoretically analyzing adversarial training loss, e.g., constant bound for Hessian and chain rule application to simplify the terms.\n3. Experiments use various settings with many baseline methods. In particular, the proposed method was tested under a powerful attack such as PGD50-10.\n\n### Weaknesses\n1. While the suggested upper bound is an impressive achievement, we need more understanding about this bound. For example, how tight is the bound in practice? If not, under what condition does this bound overestimate the AT loss?\n2. The model architectures are limited to ResNet variants, and all model architectures are too old. To demonstrate the practical value of the proposed method, we need a more thorough evaluation with more recent model architectures.\n3. While the QUB loss improves the baseline methods, the performance of other methods seems better in many cases.", "other_comments_or_suggestions": "1. Please consider adding more experiments with more recent model architecture other than ResNet variants.\n2. Another variant of QUB is to use some fixed ratio between QUB and AT loss. The ratio can be 50-50, but other ratios can be tried to find the best fit. Here, QUB can be interpreted as a regularizer term that would add the flatter loss landscape throughout the training process.\n3. Similarly, other training strategies can improve the performance, e.g., changing the $\\lambda_t$ progression.\n4. To show the effectiveness of QUB-static, we want to know that the QUB is tight enough so that minimizing QUB loss can effectively reduce the AT loss. While this tightness would depend on different conditions, both QUB and AT loss can be measured during training, so they can be plotted to show that QUB loss can be effectively used as a surrogate loss for the AT loss.", "questions_for_authors": "* How tight is the proposed QUB bound? If the QUB bound may become loose, under what circumstances?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "h1KPnfcIV8", "reviewer": "Reviewer_TY46", "summary": "This paper proposes a novel adversarial training method called Quadratic Upper Bound (QUB), defined as follows:\n$$ \\mathcal{L}_{\\text{QUB}} = \\mathcal{L}(f(x)) + (f(x + \\delta) - f(x))^T \\nabla_f \\mathcal{L}(f(x)) + \\frac{1}{4} \\| f(x + \\delta) - f(x) \\|_2^2. $$\nBy incorporating the QUB loss into existing adversarial training (AT) methods, the authors achieved notable improvements over baseline approaches.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### 1. On whether QUB effectively mitigates catastrophic overfitting\n\nWe appreciate the concern regarding catastrophic overfitting. As clarified in the main text, our goal is not to directly prevent catastrophic overfitting, but to propose a practical and lightweight strategy that enhances stability and generalization within the Fast Adversarial Training (FAT) framework.\nAs observed in Table 1 (e.g., FGSM-RS results), QUB does not completely prevent catastrophic overfitting. In particular, QUB fails to improve the performance of FGSM which is known to suffer from catastrophic overfitting. We agree that the presentation may have caused some confusion.\nAlthough QUB is theoretically motivated to promote broader generalization by minimizing an upper bound on the AT loss, its benefits may be limited when the attack is not sufficiently informative, as in FGSM-RS which generates a random attack. This is indeed the limitation of addressing structural attack weakness through loss-level regularization alone.\nThis does not contradict the theoretical validity of QUB, but rather highlights the challenge of addressing structural limitations of attack generation through loss-level regularization alone. As shown in Section 3.2, QUB helps flatten the loss landscape, contributing to generalization under perturbation constraints—even if it does not fully resolve catastrophic overfitting.\n\n### 2. On the effect of increasing perturbation size (ε) and longer training epochs\n\nWe appreciate the reviewer’s suggestion to further analyze the behavior of QUB under stronger perturbations and extend training durations. We conducted additional experiments under the same setting as Appendix E, using FGSM-RS and FGSM-PGI instead of PGD-AT.\nFor FGSM-RS, which is prone to catastrophic overfitting, we again confirmed that QUB-decreasing does not fundamentally prevent overfitting, as discussed in our response to Comment #1. While QUB-decreasing improves robust accuracy at ε = 4/255 (+4.18%), it failed to mitigate overfitting at larger ε values and even showed degraded performance compared to vanilla AT.\nIn contrast, for FGSM-PGI, which does not suffer from catastrophic overfitting by design, QUB-decreasing consistently improves robust accuracy across all perturbation sizes: +1.33% at ε = 4/255, +0.52% at ε = 8/255, +0.14% at ε = 12/255, and +0.10% at ε = 16/255. We also observed that overfitting does not occur with training epochs of up to 200.\nThese results further support our clarification in Section 4.1 that QUB is not intended to fundamentally prevent catastrophic overfitting but serves as a practical regularizer to improve the robustness of FAT.\n\n### 3. On the role of QUB as a standalone loss and clarification of Algorithm 1\n\nWe agree that the role of QUB and Algorithm 1 need to be further clarified. The QUB loss is not added to the traditional AT loss as a regularizer, but rather replaces it. That is, in our QUB-static method, we retain the adversarial example generation (e.g., FGSM-RS, FGSM-PGI) but train solely with the QUB loss, as stated in Algorithm 1.\nQUB-decreasing, by contrast, gradually transitions from QUB loss to AT loss during training, as outlined in Algorithm 2. We will revise the text to clarify this in the final version.\n\n### 4. On the potential for gradient masking due to the third term in QUB\n\nThe reviewer’s observation regarding the third term in the QUB loss, $|f(x+\\delta) - f(x)|_2^2$, and its resemblance to logit pairing is insightful and appreciated.\nWhile this term is indeed structurally similar to logit pairing, our QUB formulation is carefully designed to avoid gradient masking through the joint interaction of all three terms. The first term ensures correct classification with respect to the ground-truth label, while the second term aligns output changes along the direction of the gradient. Together, these terms mitigate the masking effect that would arise from the third term alone.\nTo empirically assess whether QUB leads to gradient masking, we evaluated our models using AutoAttack, which includes a gradient-free component (Square Attack). As shown in Table 1, QUB outperforms baseline AT models under this evaluation, indicating that the model remains robust to both gradient-based and non-gradient-based attacks.\nIn summary, while the third term may resemble logit pairing, it is not used in isolation and does not dominate the behavior of the overall QUB loss. The complete formulation ensures robust learning without relying on gradient masking.\n\n### 5. On suggestions for improving table formatting and clarity\n\nWe appreciate the reviewer’s suggestions. We agree that the proposed improvements (i.e., moving auxiliary tables to the Appendix, adding improvement margins, and unifying numerical formatting) will enhance the readability of the paper. We will incorporate these revisions in the final version.", "claims_and_evidence": "The main claim of the paper can be summarized as follows:\n\n**(Main claim)** The proposed QUB loss can be helpful in mitigating catastrophic overfitting.  \nWhile the theoretical work is valid, the empirical validation is not sufficient to conclusively prove that the proposed method effectively mitigates catastrophic overfitting.  \n\nFirst, if QUB loss truly helps prevent catastrophic overfitting, the authors should conduct experiments with larger epsilon values and longer epochs, as demonstrated in [1]. Since the experiments only use a fixed $\\epsilon=8/255$, it is difficult to claim that they provide a comprehensive evaluation.  \n\nSecond, I wonder whether QUB alone can achieve robustness. In Algorithm 1, QUB loss is optimized without any adversarial training (AT) loss. However, in the main table (Table 1), there is no standalone QUB training; rather, QUB is only used in combination with existing adversarial training methods. In this regard, I am also curious about the difference between static and decreasing weight. I suspect that Algorithm 1 is incorrect and actually uses a fixed weight for QUB loss. Please correct me if I am mistaken.  \n\nLastly, I recommend further analysis of the third term, $|f(x+\\delta)-f(x)|^2_2$, which resembles logit pairing [2]. Since logit pairing can lead to gradient masking, applying it to adversarial training might be detrimental.\n\n**Suggestions:**\n1) Please move all experiment tables to the Appendix with smaller font sizes. Since they are crucial for verifying the effectiveness of QUB, it is essential to provide them in the main text.  \n2) Please indicate the improvement when using QUB with existing methods. For example, 47.33 (+2.42). This will make the table easier to read.  \n3) Please check the significant figures in the tables. In Table 1, 47.8 should be 47.80. Moreover, right-aligning the values would improve readability.  \n\n- [1] Andriushchenko, Maksym, and Nicolas Flammarion. \"Understanding and improving fast adversarial training.\" Advances in Neural Information Processing Systems 33 (2020): 16048-16059.\n- [2] Kannan, Harini, Alexey Kurakin, and Ian Goodfellow. \"Adversarial logit pairing.\" arXiv preprint arXiv:1803.06373 (2018).", "methods_and_evaluation_criteria": "Refer to Claims And Evidence.", "theoretical_claims": "There is no problem.", "experimental_designs_or_analyses": "Refer to Claims And Evidence.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "N/A", "questions_for_authors": "Refer to Claims And Evidence.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5SLBKe6khs", "reviewer": "Reviewer_MrS6", "summary": "This work demonstrates the convexity of the cross entropy loss and derives its upper bound. Additionally, it applies this to fast adversarial robust training to enhance its adversarial robustness across multiple baselines.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### 1. Clarifying Motivation\nWe appreciate the reviewer’s comment regarding potential conflict between the stated motivation and the proposed method. We acknowledge that the terms “overly robust” and “excessively robust,” used in different parts of the paper, were not clearly differentiated.\nIn the introduction, “overly robust” refers to catastrophic overfitting in FAT, where the model performs extremely well on the specific single-step attack used during training, but fails to generalize to unseen perturbations. \nIn contrast, in Section 3.3, “excessively robust” refers to the behavior of QUB in later training phases. Because QUB is an upper bound, it may overestimate the actual adversarial loss, seeking to further minimize the loss even when the AT loss is already near zero. This can lead to undesired degradation of standard accuracy with marginal improvement of robustness.\nUltimately, both terms reflect our motivation to alleviate the overfitting tendency of FAT, and QUB was introduced as a practical strategy toward this goal.\n\n### 2. Distinction Between QUB-Decreasing and Gradual Attack Weakening\nWe appreciate the reviewer’s insightful question. Both QUB-decreasing and attack strength scheduling in AT aim to balance stability during training.\nAttack strength scheduling in AT achieves this by progressively reducing the perturbation magnitude or the number of attack steps, thereby directly controlling the strength of the perturbation $x'$. This approach focuses on reducing the loss at specific attack points.\nIn contrast, QUB-decreasing adjusts the loss function itself rather than the attack inputs. It begins with the QUB-loss to encourage a flatter loss landscape via its upper bound, promoting generalization to unseen attacks. In later stages, it transitions to the standard AT loss to avoid over-regularization and preserve standard accuracy.\nTherefore, unlike attack scheduling, QUB-decreasing operates at the gradient and loss landscape level, encouraging broader generalization beyond specific attack points. This is what differentiates QUB-decreasing from attack scheduling, and comprehensive comparison of the two strategies could be an interesting direction for future work.\n\n### 3. Computational Overhead of QUB and Reporting Training Time\nAs the reviewer pointed out, QUB-static shows longer training time than single-step baselines in Table 1. This is because QUB has two additional terms of L2 distance between logits and gradient alignment compared to standard cross-entropy loss.\nNonetheless, QUB remains computationally lighter than full loss landscape regularization, such as the smoothing term (Eq. (8) in Section 3.2), as it approximates the smoothing effect without explicit gradient backpropagation.\nAlthough QUB-static increases training time compared to single-step baselines, it achieves smoothing effects more efficiently than conventional loss landscape regularization. We will also include the missing training time information in the final version.\n\n### 4. Interpretation of Stronger Improvement on Tiny ImageNet\nWe carefully examined the reviewer’s observation that the performance improvement on Tiny ImageNet appears larger than on other datasets. The reported results were based on the average of two predefined random seeds. During the experiments, we observed unusually large improvement in FGSM-PGI setting, possibly due to seed-induced fluctuations.\nTo verify the consistency of the observed improvement, we conducted additional experiments with more random seeds. We found that the improvement from QUB varied significantly across seeds, likely due to favorable initialization rather than a dataset-specific effect. We will clarify this in the revision and avoid overinterpreting the result.\n\n### 5. Clarifying the Necessity and Suitability of QUB\nThe main goal of this work is to enhance Fast Adversarial Training (FAT) with minimal additional cost. While FAT is efficient, it often overfits to a single adversarial pattern and fails to generalize. QUB addresses this limitation by minimizing an upper bound on the AT loss, encouraging loss smoothing and broader robustness.\nThe QUB-decreasing strategy further improves the trade-off between robustness and standard accuracy by transitioning to AT loss in the later training phase. Empirical results demonstrate that QUB performs consistently better under AutoAttack, especially against unseen perturbations.\nWe will clarify this positioning more explicitly in the revised manuscript to better reflect QUB’s role as a practical and lightweight enhancement to FAT.\n\n### 6. Clarifying Related Work vs. Motivation\nWe agree that the related work is overly detailed and may better be reduced to better highlight motivation. We will streamline the related work section and improve the motivation in the final version.", "claims_and_evidence": "The author presents adequate theoretical evidence to support the method employed. However, I hold certain reservations regarding the author's motivation. The author brings up the issue of current FAT in lines 21-22 of the Introduction: \n\nFAT frequently encounters catastrophic overfitting. (The model becomes overly robust.) Nevertheless, the QUB designed by the author is a stranger attack method. (This phenomena is also mentioned by the author in Section 3.3 and the analysis of Table 1.) Thus, does the author's solution clash with the current problem of FAT as stated in the introduction?", "methods_and_evaluation_criteria": "The dataset and evaluation method used by the author are common in the field of robustness and are reasonable.\n\nThis method presents a training technique that involves using QUB initially and then reverting to normal AT （QUB-decreasing）. Can this be directly equivalent to normal AT with a gradually weakening attack strength (for instance, setting the number of attacks or the strength to gradually decrease during the training process)?", "theoretical_claims": "The author's justification for his theory is reasonable and correct.", "experimental_designs_or_analyses": "1. The QUB loss employed by the author appears to be a method that has a relatively lower computational cost compared to the general AT. However, why is it that the time of QUB-static is typically higher than the baseline as shown in Table 1?\n2. In the supplementary materials, the experiments conducted on other datasets lack time information. It is recommended to add this time information.\n3. It appears that the author's performance improvement on Tiny ImageNet is comparatively more effective than on CIFAR-10 and CIFAR-100. Do the authors possess any analysis regarding this phenomenon? Is it correlated with the input size of the image?", "relation_to_broader_scientific_literature": "Improving the effectiveness of FAT may help with the robust training of current large vision language models.", "essential_references_not_discussed": "Sufficient references have been cited", "other_strengths_and_weaknesses": "The author's presentation of the method is clear. However, the introduction to related work is somewhat excessive. It is advisable to allocate more space to offer a clearer introduction to the insight or motivation.", "other_comments_or_suggestions": "No other comments", "questions_for_authors": "1. Demonstrating the necessity and suitability of QUB loss more clearly.\n2. Demonstrate the advantage of training time on each dataset and clarify the magnitude of the difference that QUB makes in comparison to directly increasing the attack strength at the beginning of training.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zJPytwl1xh", "reviewer": "Reviewer_B7eG", "summary": "The paper presents a new adversarial training scheme based on a simple quadratic upper bound (QUB) to the standard adversarial loss, aimed at improving robustness in the context of Fast (single-step) Adversarial Training (FAT).\nThe authors demonstrate that, when applied on various adversarial training schemes from previous work, QUB can increase the smoothness of the loss landscape at a relatively small runtime cost and, in some cases, it enhances the adversarial robustness of the network.\n\n### Update after rebuttal\n\nI thank the authors for their reply, for the clarifications, and for acknowledging the limitations of QUB. I still think this is very much a borderline paper, but I am increasing my score to weak accept. I would nevertheless encourage the authors to prominently feature the large-epsilon experiments and the inability of QUB to prevent catastrophic overfitting in the next version of the paper. I would be eager to also see the outcome of the ELLE + QUB results.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### 1. On the Scope and Effectiveness of QUB across FAT Methods\nWe appreciate the reviewer’s careful analysis and valuable feedback. As the reviewer pointed out, QUB improves robustness in several FAT methods, but the improvement is limited in strong methods (e.g., FGSM-PGI) and even decreases in FGSM-RS.\nWe acknowledge this limitation. However, our primary focus was not to universally improve all FAT methods or to fundamentally resolve catastrophic overfitting. Instead, QUB aims to provide a practical, lightweight strategy to promote output-level smoothing and improve generalization without increasing attack complexity or training cost.\nIn particular, FGSM-RS is structurally prone to catastrophic overfitting, and we observed that QUB could not fully prevent this behavior. This does not undermine our method, which aims to provide a complementary regularization rather than a comprehensive solution.\nNonetheless, we agree that QUB’s effect is method-dependent, and this observation will help us better clarify the scope and limitations of our approach. In the final version, we will elaborate this point and position QUB as a practical, scalable method that can provide improvement under certain conditions, without claiming universal effectiveness.\n\n### 2. On the limited analysis for larger values of ε\nPlease refer to our response #2 to Reviewer TY46’s comment\n\n### 3. TRADES comparison\nWe agree that TRADES achieves a better robustness-accuracy trade-off than PGD+QUB in some cases (Table 1). However, in our experiments, TRADES requires approximately 1.3 times longer training time compared to PGD+QUB, which can limit its practicality in resource-constrained environments.\nIn contrast, QUB improves robustness with lower computational overhead by modifying only the loss function without changing the attack process. Our work aims to provide a simple and flexible strategy that can be easily integrated into various FAT methods without increasing attack complexity.\n\n### 4. On QUB derivation and smoothness-based alternatives\nWe agree with the reviewer that the same bound can be more intuitively derived based on the -smoothness property of the cross-entropy loss, and that this approach could simplify the theoretical presentation (although in this case, we first need to calculate a bound on the $l_2$-norm of the Hessian and then invoke the lemma that if the norm of Hessian is bounded by a constant, then the gradient is Lipschitz continuous with the same constant). In the current manuscript, we chose to derive QUB from Taylor’s theorem to explicitly connect the upper bound formulation to the local behavior of the loss landscape.\nNevertheless, we acknowledge that a smoothness-based perspective is equally valid and may offer a more straightforward interpretation. We will briefly mention this alternative view in the revised appendix for completeness.\n\n### 5. On Related Work and Clarification of Theoretical Claims\nWe appreciate the reviewer’s careful reading and valuable suggestions, which will help us improve the clarity and completeness of the manuscript.\nFirst, we acknowledge that QUB is closely related to prior works incorporating smoothness regularizers in adversarial training, such as ELLE, and shares conceptual similarities with certified training methods that provide deterministic upper bounds. We will revise the related work to explicitly mention these connections and cite the work suggested by the reviewer.\nSecond, we acknowledge that the convexity of cross-entropy is a well-known property, and the current phrasing in the introduction may have overstated this point. We will revise the statement to avoid overstating our contributions.\nAs for the high order terms in (B.1), the current statement is correct as it is. Notice that the Hessian is evaluated at some point $z$ between $x$ and $y$. If $z$ is replaced with $x$, then (B.1) would only give an approximation with missing high order terms, as the reviewer mentioned.\n\n### 6. On Evaluation of QUB Combined with Other FAT Methods\nAs the reviewer suggested, we evaluated QUB in combination with other recent FAT methods such as ELLE and N-FGSM.\nWhen applied to N-FGSM, QUB-static and QUB-decreasing improve robust accuracy by +4.85% and +2.68%, respectively with compromised standard accuracy by 1.63% and 1.25%, respectively. This further demonstrates that QUB can be effectively integrated with many FAT methods and exhibits the same trend as observed in our main experiments.\nRegarding ELLE, we agree that combining QUB with other smoothness-based regularizers is a meaningful direction. Although we could not finish experiments with ELLE within the rebuttal period, we will include the result in the final version.", "claims_and_evidence": "The main claim made in the paper is that QUB *can* improve the robustness of FAT methods. Indeed, judging from Table 1 and the experiments in the appendix, this appears to be the case when applied on a series of FAT methods. \nHowever, robustness is instead decreased for weaker FAT methods (FGSM-RS), and remains unvaried when used on the strongest considered FAT algorithms (FGSM-PGDI-MEP, and FGSM-UAP). \nFurthermore, as acknowledged by the authors in section 2.3, one of the main points of FAT methods is to prevent catastrophic overfitting.\nIt doesn't seem to me that this is explored in the paper. Indeed, the negative results when used on FGSM-RS may suggest otherwise.\n\nIn addition, I would suggest that the authors downscale a bit the claims made concerning the derivation of the proposed scheme (the intro states \"we prove the convexity of cross-entropy\": as later acknowledged in section 3, this is well known.", "methods_and_evaluation_criteria": "While different datasets and architectures are used, I am concerned by the fact that the authors chose to focus on perturbations of size 8/255, for which previous work shows a very small gap between FAT methods and multi-step baselines: see (de Jorge Aranda et al., 2022), for instance. \nAn analysis for larger $\\epsilon$ values is shown in the appendix, but it focuses on PGD-AT, which does not share the failure cases of FAT methods on larger perturbations. The practical utility of QUB in this context is unclear, considering that TRADES attains better robustness-accuracy trade-offs in Table 1.", "theoretical_claims": "QUB is derived using Taylor's theorem, stated in equation (B.1).\nHowever, it seems to me that this statement of the theorem omits the remainder term (the equality is not exact in general).\n\nRegardless, QUB can be alternatively (and, arguably, more straightforwardly) derived using the notion of $\\beta$-smoothness, which is a fairly common tool in the optimisation literature [1]. I believe the authors should acknowledge this.\n\n[1] Lecture Notes: Optimization for Machine Learning. Elad Hazan, arXiv:1909.03550", "experimental_designs_or_analyses": "See \"Methods And Evaluation Criteria\".", "relation_to_broader_scientific_literature": "As discussed by the authors (section 2 is fairly comprehensive), this work fits within a long series of works aiming to improve the robustness of FAT schemes. In particular, it is very related to works integrating smoothness regularisers into the loss function (for instance, ELLE): this is particularly related to the third QUB term.\n\nQUB is only one way to provide an upper bound to the adversarial loss. For instance, upper bounds can be alternatively derived using deterministic certified training algorithms. A concurrent work explores the utility of these methods in the context of FAT [2]. This could be acknowledged for the sake of completeness.\n\n[2] On Using Certified Training towards Empirical Robustness, De Palma et al., arXiv:2410.01617", "essential_references_not_discussed": "No essential references are omitted.", "other_strengths_and_weaknesses": "I found the idea of using the quadratic upper bound to enhance robustness to be intuitive and interesting.\nHowever, its empirical utility compared to previous work in the area remains to be fully determined (see questions).", "other_comments_or_suggestions": "No other comments or suggestions.", "questions_for_authors": "- Can QUB prevent catastrophic overfitting? This can be proved by applying it on top of vanilla FGSM on CIFAR-10 for 8/255.\n- Could the authors analyse performance for larger perturbation values on top of other FAT schemes (the appendix only uses PGD-AT)?\n- Could the authors provide results for using QUB on top of ELLE (a state-of-the-art FAT regularizer) or N-FGSM (arguably the best-performing FAT method without any runtime overhead)?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper derives a quadratic upper bound on the adversarial training loss function and proposes using this bound with existing fast adversarial training methods to improve robustness. The reviewers found the paper’s findings to be novel contributions. They also provided suggestions for improving the presentation of the paper, including adding additional experiments and explaining the limitations of the proposed technique in preventing catastrophic overfitting.
Decision: Accept (poster)