Vulnerable Data-Aware Adversarial Training
Authors: Yuqi Feng
Jiahao Fan
Yanan Sun
Venue: NeurIPS 2025 poster ()
Keywords: Adversarial Training
Adversarial Robustness
Decision Boundary Analysis
Primary area: deep_learning

Abstract: Fast adversarial training (FAT) has been considered as one of the most effective alternatives to the computationally-intensive adversarial training. Generally, FAT methods pay equal attention to each sample of the target task. However, the distance between each sample and the decision boundary is different, learning samples which are far from the decision boundary (i.e., less important to adversarial robustness) brings additional training cost and leads to sub-optimal results. To tackle this issue, we present vulnerable data-aware adversarial training (VDAT) in this study. Specifically, we first propose a margin-based vulnerability calculation method to measure the vulnerability of data samples. Moreover, we propose a vulnerability-aware data filtering method to reduce the training data for adversarial training thus improve the training efficiency. The experiments are conducted in terms of adversarial training and robust neural architecture search on CIFAR-10, CIFAR-100, and ImageNet-1K. The results demonstrate that VDAT is up to 76% more efficient than state-of-the-art FAT methods, while achieving improvements regarding the natural accuracy and adversarial accuracy in both scenarios. Furthermore, the visualizations and ablation studies show the effectiveness of both core components designed in VDAT.

Vulnerable Data-Aware Adversarial Training
Yuqi Feng, Jiahao Fan, Yanan Sun"
College Computer Science, Sichuan University feng7706230gmaill com, fanjh@scn edw.. en, ysundscn. edu.
Abstract
Fast adversarial training (FAT) has been considered as of the most effective alternatives to the computationally-intesiiii methods pay equal attention each sample of the target task. However, the distance between each sample and the decision boundary is different, learning sam- ples which are far from the decision boundary (i.e., less important adversarial robustness) brings additional training cost and leads to sub-optimal results. To tackle this issue, we present vulnerable data-aware adversarial training (VDAT) in this study. Specifically, we first propose a margin-based vulnerability calculation method to measure the vulnerability of data samples. Moreover, we propose a vulnerability-awaal data filtering method to reduce the training data for adversarial training thus improve the training efficiency. The experiments are conducted terms of adversarial training and robust neural architecture search on CIFAR-10. CIFAR- 100, and ImageNet- 1K. The results demonstrate that VDAT is up to 76% more efficient than state-of-the-arr FAT methods, while achieving improvements regarding the natural accuracy and adversarial accuracy in both scenarios. Further- more, the visualizations and ablation studies show the effectiveness of both core components designed in VDAT.
adversarial training. Generally, FAT
Introduction
Adversarial training has been demonstrated as one of the most effective techniques 35 the adversarial robustness of deep neural networks. However, standard adversarial training methods are shown be time-conee consuming due to the multi-step gradient calculation and backward propagation for generating the adversarial examples 35 [6]. Regarding this problem, fast adversarial training (FAT) methods [44 [8] are proposed to reduce the computational budget of standard adversarial
to enhance
training. Currently, most of the FAT methods mainly focus on generating adversarial examples more efficiently [39]. In particular, FAT methods often replace the multi-step adversarial example generation with the single-step one, thus improve the efficiency of adversarial training the whole dataset. However, recent studies demonstrate that some data samples are not important to adversarial robustness, and learning these samples increases the training time but contributes little to the performance (20 47 As result, the efficiency and efficacy of FAT methods limited.
In order to reduce the scale of training data and further improve FAT methods, some studies have proposed FAT methods based on data filtering 113
These methods mainly adopt the batch- wise filtering manner to select subsets of the training data. For example, some methods evaluate the contribution of batch data based on the related adversarial and natural losses (3), the gradient approximation error of subsets of data [33,, the filling degree of the corresponding input spaces segments [47]. However, these methods do not take the vulnerability of each samples in one batch into account, limiting the performance of adversarial training. Specifically, the distance between different data samples and the decision boundary different according to previous studies [57 50].
"Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Class
Class
Batch-wise Sampling
PAD
140
Adv Example
Natural
Non- Huteraabe Hatrerabte
Vumerabia
muinurable
Non-
Accuracy 080
Removed
Selected
40-
88
VDAT
20
Non- Vulnorable
Class
Vulnerable
Natural
PGD50
Cost
Netrics
Figure 1:
The core idea of VDAT and state-of-the-ar FAT methods Figure 2: The performance on ImageNet- IK.
based on data filtering.
Consequently, the vulnerability of data samples is different under the adversarial attack with the same strength. An example shown in the left part of Figure [ where the gray, green, and blue samples are less vulnerable than the yellow, red, and purple ones. Because the random allocation of batches, each batch is likely contain both vulnerable and non-vulnerable samples shown in the upper right of Figure I Suppose the first batch is considered to be less representative than the second batch by the method, and then only the second batch will be learned because of the batch-wiss filtering manner. As result, the vulnerable samples in the first batch are not learned, while the non-vulnerable ones in the second batch are learned, thus hindering the overall performance and efficiency.
In this study, we introduce vulnerable data-aware adversarial training (VDAT) to tackle the above issue of existing FAT methods based on data filtering. As shown in the lower right part of Figure [ the main idea of VDAT is to perform the sample-wise vulnerability evaluation, and then detect the vulnerable samples and learn them in targeted way. This goal is achieved by two core components designed. First, we propose a margin-based vulnerability calculation method, so as to determine the vulnerability of each sample in the given dataset. The vulnerabilityy directly measured by the decision margin between the natural data and adversarial examples, thus the computational cost is low. data filtering strategy, to reduce the number of samples for adversarial training while learn vulnerable samples more robustly. In this strategy, each data sample given a certain probability to be changed to adversarial example, and the probability calculated according to the vulnerability of this data sample. The more vulnerable data samples will have larger probability to be changed into adversarial examples. As a result, the vulnerable samples are learned robustly in the training process, thus the overall performance is improved while maintaining low training cost as shown in Figure The contributions of this work are summarized as follows:
Second, we propose vulnerability-ave
We bring new perspective to FAT. Different from the mainstream perspective focusing on the batch-wir wise data filtering, we mainly focus on the sample-wise data filtering to adversarially learn the vulnerable data samples.
We propose VDAT with the margin-based vulnerability calculation and the vulnerability- aware data filtering, improve the performance of FAT and lower the computational cost.
We show that VDAT achieves the ofte--of-the-ar performance regarding both natural and adversarial accuracy on CIFAR-10, CIFAR- and ImageNet- IK, while bringing up to 76% efficiency improvement. addition, VDAT is also effective improving performance and efficiency in the scenario of robust neural architecture search (NAS).
2 Related Work
2.1 Fast Adversarial Training (FAT)
FAT is kind of method designed to accelerate the time-consuming training process of the standard adversarial training 444 In general, most FAT methods mainly focus on the efficient generation of adversarial examples [ [25]. For example, Jia et al. (28) propose a input data data-aware adversarial example initialization method, to generate adversarial examples which are beneficial to both natural accuracy and adversarial robustness in single-step manner. Tong el al.
45 propose the taxonomy driven FAT method to overcome the catastrophic overfitting (30] via optimizing learning objective,
loss function, and initialization manner jointly. Jia al. [27] propose prior nowledge-guides

---

adversarial example initialization method, to improve the quality of adversarial examples generated and overcome the catastrophic overfitting. Although these methods have achieved decent performance. they still need to train on the whole dataset with samples contributing little to the adversarial robustness [47], thus limiting the efficiency. Therefore, we mainly focus on the perspective about data filtering in this study, to further improve the efficiency of FAT.
2.2 Decision Boundary Analysis
The studies regarding decision boundary analysis mainly lie in three perspectives, i.e., enhancing the adversarial training, improving the adversarial attacks, and interpreting the decision mechanism of deep neural networks. In the first category, existing methods mainly focus dynamically adjusting the decision boundary during the training adversarial robustness of the model. In the second category, existing studies leverage the decision boundary information to enhance both white-box and black-box attacks based on learning 9 43 to evaluate the adversarial robustness more accurately. In the third category, the mainstream direction is to explore the relationship between the data, features, and the decision boundary during the adversarial training [6 377. Then, the information about the features and decision boundary can be adopted to interpret the shift of decision boundary of the neural network during adversarial training. Different from these studies, we focus on data filtering from the decision boundary perspective in this work. Specifically, we estimate the vulnerability of data samples to determine vulnerable ones based on decision boundary analysis, to improve both efficiency and efficacy of FAT.
50, 4. to improve both natural accuracy and
2.3 Robust Neural Architecture Search (NAS)
Robust NAS aims to automatically design robust neural architectures against adversarial at- tacks 124
14 18] Generally, most robust NAS methods are constructed based on differentiable NAS methods 34 51) which need to optimize the trainable weights and architectures parameters in supernet. To ensure the adversarial robustness of the derived architectures, robust NAS methods often adopt adversarial training techmiques in the optimization of above variables. For instance, Mok et al. (36) adopt adversarial training obtain the input-loss landscape, and then update the architecture parameters based on this indicator. Qian et al. [41] adopt adversarial training to update trainable weights and architecture parameters, to reduce the non-robust feature distortion and enhance the adversarial robustness of derived architectures. Ou et al.
(38 propose a multi-objective search strategy to balance the losses of natural training and adversarial training. In our experiments, replace the adversarial training in robust NAS with VDAT and other state-of-the-an FAT methods, to evaluate the scalability of VDAT in terms of searching for adversarially robust neural architectures.
3 Preliminaries
According to the common practice of adversarial training 27. we define the target neural network parameterized by 0 as fo: R2 + R. Given data sample x E X' and the corresponding label y E 21,2..... k). the network can be further denoted as fo(x) = arg (1.2 (8(x), where (g (z) denotes the logit for class c. Based on this, the decision margin MM (z)) of the data sample can be denoted as Equation ① according to the previous study [50].
My
(x) max oy (z)
y'
The main goal of the proposed VDAT method is to detect the vulnerable data samples, i.e., data sam- ples having relatively smaller decision margin between themselves and the corresponding adversarial examples. Then, the data samples detected are collected construct a subset of data for adversarial training, thus reducing the computational budget and improving the overall performance.
4 Vulnerable Data-Aware Adversarial Training
The overall framework of VDAT is shown in Figure 3 As can be seen, the proposed VDAT method works on the natural data samples, through adversarial perturbation, and two core components, i.e., the margin-based vulnerability calculation and the gulnerability-awee samples for natural training and adversarial training are determined and adopted to train the neural network. The details of both core components presented in the following sections.
data filtering, then the data
3

---

AM
Margin Transformation
Vulnerability Calculaaionn
S4
Adversarial Perturbation
Hard
Marging
Vg(x:) Ve(Ka) ... (a(
A.M.
Vunerrbility Samples
Vulnerability Calculation
Data Filtering
Nai
Adv Tran
Falta
Puta) s Rand(U.1)
Natural Training
Samples
0.24
Probability Calculation
PaPa
PaDx) Rand(0.1)
Adversarial
Vulnerabillty of Samples
Training Samples
VDAT
Data Filtering
Figure 3: The illustration about the overall framework of VDAT. After adding adversarial perturbations to generate adversarial examples, the margin- based vulnerability calculation and the vulnerability- aware data filtering are performed sequentially.
4.1 Margin-based Vulnerability Calculation
After generating adversarial examples X' in the first step of VDAT, the margin-basee vulnerability calculation will play the role in calculating the vulnerability of each sample in X. Specifically, the vulnerability (1( of x; is represented by the difference between the logit margins of both natural sample x2 E X' and the corresponding adversarial example xi E X2, as shown in Equation (
Vo(x;)
Mx, (²
where denotes the true label of the data sample H₁- Besides, the physical significance of the subtraction is the margin difference in the decision space between x; and 24- The larger absolute value of that subtraction denotes the larger margin difference, indicating the natural data is harder to be attacked and has lower vulnerability.
However, both (x;) and (z are hard margins formulated by the maximum operator. In this way, the logit margin is calculated only based on logits of the class y and the class with the largest logit given by the model fe. Unfortunately, there existing targeted adversarial attacks [35). and the adversarial example H; can be misclassified into each possible class based on such kind of attacks. Therefore, formulating the logit margin with only one class y' + y cannot well cover all possible situations. To this end, we formulate the soft margin S (1,, T) and S (xf for both x; and x motivated by [50]. The detailed formulation is shown in Equations (3) and where 7 is a pre-determined hyperparameter.
(x,, ox()))
log Σ
exp(roX (x.))
y Ky
(x4)== - log Σ
exp(TTl) (x())
(4)
y J'
Based on the soft margins, the vulnerability of the data sample o; can be rewritten as Equation 5
Vo(o;) = (x, S (x{))
In the following, discuss the motivation of adopting the margin difference instead of the pure
margin of the single data sample. The reason is that the pure margin only reflects the output situation
of the model and cannot represent the information of decision boundary [50]. In contrast, adopting
the margin difference can avoid the above problem, this is because the pure margin of adversarial examples carries the decision boundary information 29 Specifically, the decision boundary (33
is characterized based on certain data sample f. the true label ý of à. and another label y + J. If
this data sample satisfies ( = 2% (.), then we assume that the data sample á is on the decision boundary between classes and y' In practice, the problem is that the sample f often cannot be accurately found [50]. Fortunately, previous studies 9 state that the adversarial attack can push sample towards the decision boundary, thus the logit margin of adversarial examples can well reflect the decision boundary information in some cases. Based on this, we adopt the margin difference to calculate the vuinerability in this study.

---

4.2 -ulnerabilityAAware Data Filtering
Based on the vulnerability V (21( Vo(2)).... .... Vo( calculated for the natural data samples P2..,....... ..n the data samples are filtered for natural training and adversarial training accordingly. Specifically, each sample 2; given a probability (z;) to be changed the adversarial example for adversarial training. The higher the vulnerability of z; is, the larger the probability Po())) is, in order to help the model learn this vulnerable sample more robustly. The details of the calculation of (ar2) are presented as follows.
To build the connection between the vulnerability and the probability Po(x;), we normalized the vulnerability Va(=;), for the convenience of determining the probability. In particular, the calculation for the probability Pa (2;; is formulated as Equation (6):
Vo(a;)) Vo( T2, ,.......))...........
+1)
Po(x,) = 2 max Vo(a;) Vo(=)) 1
(6)
where Vo(21, 22............... (nn denotes the average value of the vulnerability in V. The range of Pa narrowed from zero to one by calculating in this way.
After determining the probability for each data sample, the data filtering can be performed accordingly. Specifically, the filtering process is described by Equation 77
J3 + 6, R(0, 1) S Po(a.) Tz. R(0,1) 1) > Po(a:)
F(x;)
=
where 5 denotes the adversarial noise generated by the specific adversarial attack of adversarial training, R(0, 1) denotes a uniform random value ranged from zero one. In this way, the data samples with the higher vulnerability are more likely changed to adversarial examples, to help the target model learn them more robustly.
When the filtered data F(x;) is determined for all data samples in X' = { 22, Inh. the datasets for natural training and adversarial training can be obtained. Supposing there data samples filtered for adversarial training, we denote the datasets for natural and adversarial training as Xudi {#1, f2 2.,..., and Xuat {Im+11, fm
Tn). then the overall training loss Luain is
formulated as Equation
Luain (aat 0) + Ladv (Nadv: 9)
Based on this, we present the whole training process of VDAT in Algorithm [ As can be seen, the data filtering is performed with a pre- defined interval T in the whole training process (line 2 During the data filtering, the probability (x calculated in the first step (line 3). and then the data filtering and the update of Xnat and Katv are performed sequentially (lines 4 and (5). Moreover, the network parameter 0 is updated based on calculating the training loss Lizam in each epoch (line 7) Finally, the trained model
Algorithm 1 VDAT
Input: Target dataset X' target model with param- eter 8, training epoch N, and interval T. Output: The trained model with parameter #*.
1: for = 0 to N do
2: if mod T - then
3: Calculate (o;);; for each sample in X'
4: Perform data filtering in Equation (
5:
Update datasets Xaa and Xadv
6: end if
can be obtained. It is worth noting that we intro- duce a hyperparameter T indicating the interval of data filtering. This because the data filter- ing introduces additional computational budget
7: Calculate Limin and update 0
8: end for
9: Return The trained model with 0*
in the training process due to the vulnerability calculation, and this hyperparameter can balance the total training cost and the performance of the trained model. Detailed analysis of this hyperparameter is presented in our experiments. Besides, additional details regarding the workflow of VDAT can be found in Appendix A
4.3 Time Complexity Analysis
In this section, we present the time complexity analysis of the proposed VDAT method. For the margin-based vulnerability calculation, because we need to iterate over all samples in the target
5

---

dataset X, the time complexity for this process is (n). Meanwhile, calculating the soft margin for each sample needs iterate the logits for all & classes. As result, the time complexity for this process is (k),, and the overall time complexity for the margin- prrgin-based vulnerability calculation is (nk)). For the vulnerability-awaa data filtering, we also need to iterate all data samples and calculate the probability P of each data sample, and the time complexity for this process is (()). ). In summary, because the above two parts are performed serially, the overall time complexity (mk)..
Experiments
5.1 Experimental Settings
In order to comprehensively demonstrate the effectiveness of VDAT, we adopt VDAT to train baseline models, i.e., ResNet (33] and WideResNet (54), which are widely used in the community
of adversarial training to test the performance of adversarial training techniques [8 27]. Besides, the benchmark datasets for adversarial training or robust NAS are CIFAR- 10, CIFAR-
31] and ImageNet-IK [12]. while the adversarial attacks for evaluations are FGSM 21 PGD
35
C& (2), and AutoAttack (AA) [0]. These choices also follow the conventions in the communities of adversarial training and robust NAS (50 [9]. Besides, the hyperparameter of VDAT is set to five and the interval T set to ten. The adversarial perturbation adopted before the vulnerability calculation is generated by the FGSM attack. Moreover, because VDAT can be combined with different types of adversarial perturbations for adversarial training, we adopt commonly used FGSM and PGD adversarial perturbations. These two variants of VDAT are denoted VDAT and VDATPGD our experiments, respectively. More details regarding the experimental settings are in Appendix B
Table Experimental results of the adversarial training CIFAR-10 and CIFAR-100. The baseline models are ResNet18 and WideResNer34-10. The best results are in bold and the second best results underlined.
Adversurial Attacks
Training Cost
Models
Methods
Natural (%)
(%)
PGD (%)
PGD (%)
(%)
(%)
Hours)
CIFAR-10
PGD-AT 55
82.32
55.12
52.60
48.66
4.45
FGSM-SDI
28
81.86
59.96
52.54
52.18
51.00
48.50
1.38
82.67
2.29
PCKM-PGK 2
81.58
62.04
55.51
55.31
51.17
49.51
1.30
VDAT
82.96
62.26
56.08
56.07
$2.85
$3.89
T.96
VDAT
PGD-AT 35
85.17
59.78
55.07
54,87
$1.84
$1.67
31.90
FGSM- SDT
28
86.40
54.95
$4.60
$3.68
$1.17
9,40
WideResNec34100
RGSM-PGK
TDAT
X7
83.32
87.69
63.26
$8.23
43.38
41.53
$7.46
$4.33
46.71
53,28
22.58
9,09
8.30
VDAT
DAATRSMM
92.34
65.08
$9.49
58.30
$5.42
$4.49
3.41
CIFAR-100
PGD-AT
35
$7.50
30.95
29.00
90
27.60
25.448
4,73
FGSM-SDI
28
58.54
37.19
27.99
27.67
25.55 85
23.27
1,65
ResNet18
57.32
2.29
FGSM-PGK
27
$6.27
37.40
32.85
29.92 92
28, 39
26.86
1.30
VDAT
54.44
40.36
34.29
34.26
29.34
31.44
2.01
ROSM
PGD-AT 38
60.63
31.39
26.21
25.92
23.96
21.41
31.90
FGSM
WideResNee54.10
TDAT
63.07
40.51
29.04
27.77
29.16
25.15
9.25
FGSM-PGK
64.22
40.54
30.04
29.73
27.82
26.11
8.30
VDAT PoD
VDAT
72.91
41.90
31.64
33.53
31.01
31.65
3,44
5.2 Overall Results for Adversarial Training
To demonstrate the efficiency and efficacy of VDAT, we compare VDAT with state-of-the-art FAT methods focusing on 1) efficient generation adversarial examples and 2) data filtering. Specifically, we adopt different adversarial training methods train baseline models, and then the natural accuracy, adversarial accuracy under different adversarial attacks, and the training cost are reported. The benchmark datascts for this set of experiments are CIFAR- 10, CIFAR- 100, and ImageNet-1K.

---

As for the first category of FAT methods, the experimental results on CIFAR- 10 and CIFAR- 100 are presented in T As can be seen. both FDMT and VDAT achieve state-of-the-ar natural accuracy and adversarial accuracy in most cases. Meanwhile, because VDAT only performs adversarial training on the filtered subset, VDATFGSM is more efficient than the state-of-the-ar FGSM-based FAT methods, i.e., FGSM-SDI, TDAT, and FGSM-PGK. Moreover, VDAT PGD is also much more efficient than standard PGD-AT, and it does not increase much training cost compared with FGSM-based FAT methods. Furthermore, the experimental results in Table also show that VDAT performs better than VDAT on natural accuracy and weak adversarial attacks, while VDAT FOSM is not good VDATEGD stronger attacks. Specifically, VDAT outperforms VDATrGD in terms of natural accuracy and adversarial accuracy under the FGSM adversarial attack. As for the stronger adversarial attacks, i.e. C&W and AA, VDAT often performs better than VDAT This is mainly because VDATPGD provides stronger adversarial examples, and learning these adversarial examples can help the model achieve better accuracy under stronger adversarial attacks. However, it is shown that stronger adversarial examples can lead to robust overfitting of the strong adversarial perturbations [53] As result, the model suffers from the poor generalizability to the clean data and weak adversarial examples, thus the natural accuracy and adversarial accuracy under weak adversarial attacks become lower.
Beyond CIFAR-10 10 and CIFAR-100, we also conduct experiments on ImageNet- 1K against sfate-of- the-art FAT methods in the first category, to demonstrate effectiveness and efficiency of VDAT on the large-scale dataset. As can be observed from Table 2 VDAT achieves the highest natural accuracy and adversarial accuracy under both PGD 10 and PGD adversarial attacks. Mcanwhile, VDAT is at least 9.6% more efficient than the state-of-the-ar FGSM-based FAT methods. In conclusion, VDAT demonstrates superior efficiency and efficacy compared with state-of-the-an FAT methods in the first category.
Table 2: Experimental results of the adversarial Table 3: Comparisons between the state-of- training on ImageNet-1K 1K. The baseline model for the-art data filtering-bssed FAT and VDAT on training is ResNet50.
CIFAR-10, CIFAR- 100, and ImageNet-IK:
Adversarial Attacks
Training Cost
Model/ Datasets
Methods
Natural (%)
(%)
Cost
Methods
Natural (%)
PGD
PGD (%)
Hours)
AdaCealMocch 13
84.54
47.83
17:21
PGD-AT
135
35.41
CIFAR-10
DFEAT D
YDAT
85.66
92.34
54,49
52.77
10.30
3.11
Fiee-AI
33.08
RGSM-PGI
26
34.03
DREAT
66.31
30.65
14:35
FGSM SDI
28
59.62
37.50
36.63
44.53
CIBAR 100
VDATmw
72,91
31,65
3.44
RGSM-PGKK
66.24
33.13
35.70
42.47
ResNed0
DREAT
64.76
36,10
53.72
VDATrosM
67.47
39.48
38.69
35.41
ImageNe-1K
VDATTGM
67.47
36.95
38.41
Regarding the FAT methods falling into the second category, we choose the state-of-the-art methods, i.e. AdvGradMatch [13] and DFEAT [3], and then directly report the experimental results presented in their seminal papers. The experimental results are shown in Table 3 As can be seen, VDAT demonstrates superior performance on all three datasets comparing with the FAT methods selected. Meanwhile, the training cost of VDAT is significantly lower (2 28.5% lower) than that of AdvGrad- Match and DFEAT both medium scale datasets (CIFAR-10 and CIFAR-100) and the large-scale dataset (ImageNet- K), thus illustrating the superiority of VDAT.
5.3 Overall Results for Robust NAS
In order to evaluate the scalability of VDAT in different scenarios, we conduct experiments in terms of robust NAS. Specifically, we directly replace the PGD-based adversarial training with different FAT methods in the optimization of the supernet, to obtain robust neural architectures. Then, the derived architectures are adversarially trained by the PGD adversarial training following the conventions [38 [7]. The experimental results are shown in Table 4
As can be seen from Table 4 the natural accuracy becomes higher when the robust NAS method is combined with VDAT, and this accuracy is also higher than that in cases of FGSM-SDI and FGSM- PDK. Meanwhile, the adversarial accuracy reaches the best in most cases after introducing PDDTPOD or VDAT Besides, the search cost becomes the lowest after introducing VDATFOSM. and the search cost also becomes lower than that of vanilla robust NAS methods after introducing VDAT These experiments demonstrate the scalability of VDAT in the scenario of robust. NAS. Furthermore, it can be observed that VDATFGSM generally performs better than VDATPGD on both natural accuracy and ad adversarial accuracy. This phenomenon is mainly caused by the overfitting phenomenon of the
7

---

Table 4: Experimental results of VDAT CIFAR-10 under white-box attacks. The adversarial
training methods are integrated into the corresponding robust NAS methods.
Adversarial
Search Cost
Models
Params
Natural
FGSM
PGD
PGD (%)
C&W (%)
AA (%)
(GPU Days)
DSRNA 24
2.0M
80.93
54,49
49.11
48.89
38.92
44.87
0.80
+ FGSM-SDU SDI
1.9M
86.32
55.38
43.62
43.04
16.17
41.64
0.53
FGSM PGK
27
2.7M
85,98
59.40
50.65
50.13
52.64
48.05
0.43
3.2M
87.21
62.24
$3.29
53.13
52.98
48.16
0.65
PDST
3.4M
91.10
84,23
64.01
54.64
55.89
50.26
0.34
AdvRush
(30
4.2M
87.30
60.87
53.07
52.80
45.13
50.05
1.22
FGGM-SDD
50.78
0.74
FGSM-PGK
Mi
3.7M
86.28
59,
50.31
49.74
51.86
47.15
0.59
+ VDAT
3.5M
$7.89
62.60
54,27
S4.11
52.25
0.76
VDATTOSM
3.6M
88.05
63,35
55.32
54,84
46.42
54,38
0.47
RNAS [I]
3.5M
84.13
61.90
53.48
$3.35
50,74
50.54
0.71
FGGMM-SS
58.32
49.38
0.42
FGSM-PGE PGK 27
3.3M
84,68
55.24
45.47
44.89
49.89
43.84
0.34
VDDT
VDAT
3.7M
87.18
62.99
55,43
55.13
54.61
53.54
0.27
ARNAS 3S
4.5M
85,92
62.45
55.87
55.43
28.14
$2.66
2.95
FGSM-SDI
5.0M
86.86
60.51
51.59
50.92
26.25
48.33
1.81
FGSM-PGK
3.7M
87.11
60.74
32.92
52.45
25.31
50.43
1.44
VDAT
5.7M
56.85
38.24
2.22
+ VVDAT
5.0M
89.34
65.67
57.15
56.81
30.34
56.11
1.15
supernet. Specifically, VDATPGD will cause robust overfitting more easily than VDATFGSM during the training process of the supernet (53]. As indicated in the previous study (55). the overfitting make the NAS algorithm add more parameter-free operations (e.g., skip connection) to the derived architecture. As a result, the architectures searched with VDATPGD demonstrate lower natural accuracy and adversarial accuracy than those searched with VDAT FOSM. Please note that additional experimental results regarding robust NAS can be found in Appendix
5.4 Visualizations of VDAT
Visualizations of the Training Process. Because the data filtering in VDAT changes the training data for both natural training and adversarial training iteratively, we explore the convergence of VDAT by visualizing the training process, in order to show the reliability of VDAT. As can be seen from Figure ! no matter which dataset or baseline model is adopted, the training of VDAT converges well. Please note that the significant accuracy improvement the 100-th training epoch is mainly caused by the decay of the learning rate. This practice follows the convention adversarial training (28). Besides, because the data filtering method can change the training data iteratively, VDAT does suffer from the catastrophic overfitting [30) even though the FGSM-based adversarial training is combined with VDAT.
120
20
193 P0
102
20
102
(a) ResNet (C10)
(b) WideResNet (C10)
(c) ResNet (C100)
(d) WideResNet (C100)
Figure 4: Visualizations of the training processes of VDATFOSM and VDAT CIFAR-10 (C10)
and CIFAR-100 (C100).
Visualizations of the Vulnerability of Data Samples. To further show the effectiveness of VDAT regarding learning vulnerable samples, we visualize the normalized margin difference before and after training. A larger normalized margin difference indicates lower vulnerability. As shown in Figure 5] the distribution shifts to right after training with VDAT on all three datasets, demonstrating VDAT indeed effective in learning vulnerable data samples robustly. Additional visualizations for the training process and the normalized margin difference can be found in Appendix D

---

Bolore Trahingg Alter Traiiing
Sefore Traking After Trariing
630002
Before frasing
After rairing
Samples
Numb Samples
Mumber of Samples
520002
0200
420002
0032
9200
320002
6032
+200
230003
2002
Margin Difference
Normalized Margin
Normalized Margin
(a) CIFAR-10
(b) CIFAR-100
(c) ImageNet-1K
Figure 5: Visualizations of the normalized margin difference data before and after training by
VDATRGSM. The baseline models are ResNet18 (CIFAR-10/100) and ResNer50 (ImageNet-IK)
5.5 Parameter Studies and Ablation Studies
Parameter Studies. We conduct parameter studies for the hyperparameter т and the interval T. As shown in Table 5 the performance raises when increases from 0.05 to five, and then slightly decreases when 7 increases from five 500, illustrating the validity setting shown in Table 6 both natural accuracy and adversarial accuracy decrease when T becomes larger, but the training cost becomes lower. To balance the accuracy and training cost, we choose to set to 10 default.
five. Moreover, as
Table 5: Parameter study for the hyperparameter т on CIFAR-10. The baseline model for adversarial CIFAR-10. The training cost is measured in training ResNet18.
Table Parameter study for the interval T on
GPU hours.
Natural (%)
PGD (%)
PGD (%)
T
Natural (%)
PGD (%)
Cost
0.05 (x0.01)
85.88
48.53
48.41
(x0.2)
91.37
1.47
0.5 (x0.1)
85.96
53.95
53,90
(x0.5)
88.39
54.74
1.20
5 (Default)
86.32
56.30
56.23
10 (Default)
86.32
56.23
1.04
50 (x10)
86.25
54.14
54.00
20 (x2)
82.94
44.95
0.69
500 (x100)
86.32
53.27
53.12
50 (x5)
81.81
43.91
0.63
Ablation Studies. The ablation studies mainly focus on the filtering method, the kinds of adversarial perturbation adopted before the vulnerability calculation, the soft margin along with the temperature parameter t adopted, and the different adversarial training frameworks.
As be in Table 7 when filtering method is removed or replaced by the random filtering, both natural and adversarial accuracy drops, demonstrating the effectiveness of the filtering method designed. Furthermore, shown in Table 8 the natural accuracy and adversarial accuracy do not show significant changes when changing the types of ad adversarial attacks, but the search cost increases when changing FGSM PGD. Therefore, we choose FGSM attack default.
Table 7: Ablation study for the filtering method on CIFAR-I0. The baseline model for training is ResNet18.
Table 8: Ablation study for the kind of adver- sarial perturbation adopted before the vulner- ability calculation.
Filtering?
Natural
2I (%)
PGD (%)
Perturbation
Natural (%)
PGD (%)
Cost
Without
73.81
41.55
41.26
PGD
85.96
58.03
1.10
Random
85.0 96
50.96
48.84
85.96
58.50
1.34
VDAT
86.32
56.30
56.23
FGSM
86.32
56.23
1.04
Moreover, we conduct ablation studies regarding the soft margin along with the temperature parameter The effectiveness of the above design is evaluated under the targeted attacks. Specifically, we train ResNet18 on CIFAR-10 10 with two types of margins, i.e., the pure margin Equation (2) and the soft margin with different values of 7. For evaluation, the targeted adversarial attacks are variants of the PGD adversarial attack, i.e., PGD (Random) and PGD (Least Likely). PGD (Random) indicates that the target labels chosen randomly. PGD (Least Likely) indicates that the target label is the

---

Table 9: Experimental results of the ablation study regarding the soft margin and the temperature
parameter т. The baseline model is ResNet18 and the benchmark dataset is CIFAR-10. 10.
Random
Least Likely
Methods
Natural (%)
PGD 20
(%)
PGD 50
(%)
PGD 20
(%)
PGD 60 (%)
Pure Margin
84.53
56.21
56.04
75.45
75.24
Soft Margin (r=0.05)
85.88
63.28
63.20
77.84
77.65
Soft Margin (r=0.5)
85,96
69.32
68.86
82.07
81.94
Soft Margin (r=1)
85.88
70.00
69.31
82.06
81.84
Soft Margin (5=5)
86.32
72.75
72.35
83.31
83.28
Soft Margin (r=50)
86.25
71.20
70.61
82.20
82.02
Soft Margin (T=500)
86.32
69.55
69.53
80.75
80.44
label corresponding to the smallest output logit. Both attack strategies for selecting target labels are designed following the convention [32. As shown in Table the adversarial accuracy under targeted adversarial attacks increases when the pure margin is changed to the soft margin. Consequently, soft margin is shown to be effective to improve the adversarial accuracy under the targeted adversarial attack. Furthermore, when the temperature parameter т is set to five, the adversarial accuracy becomes the highest, demonstrating the validity of setting 7 to five as default.
Table 10:
Experimental results of the ablation study in terms of different adversarial training frame- works. The baseline model is ResNet18 and the benchmark dataset CIFAR-10.
Adversarial Attacks
Training Cost
Methods
Natural (%)
FGSM (%)
PGD (%)
PGD 50 (%)
(GPU Hours)
TRADES [56
81.16
60.27
52.45
52.39
6.44
TRADES + VDAT
81.43
61.15
55.55
55.50
3.27
AWP 49
81.97
58.47
53.98
53.91
7.15
AWP VDAT
83.97
62.32
56.03
55.93
3.76
In addition, perform ablation studies to demonstrate the flexibility of the proposed VDAT method. In particular, we integrate VDAT into AWP (49] and TRADES [56] adversarial training frameworks. In this set of experiments, the benchmark dataset is CIFAR-10 and the deep neural network for training is ResNet18. The natural accuracy, adversarial accuracy, and training cost are reported in Table TO As can be seen, VDAT improve the natural accuracy and adversarial accuracy of both TRADES and AWP. Meanwhile, the training cost of both TRADES and AWP is decreased owing the integration of VDAT. In summary, VDAT is shown to enjoy the flexibility across different adversarial training frameworks.
Please note that additional experimental results regarding the parameter study and ablation study can be found in Appendix
Conclusion
In this paper, mainly focus filtering the vulnerable data in the adversarial training process. This goal is achieved by the proposed VDAT method with two core components, i.e., the margin-based vulnerability calculation and vulnerability-awree data filtering. The experimental results demonstrate the effectiveness and scalability of VDAT. In addition, the validity of core components designed in VDAT is shown by the ablation studies. In the future, will put the effort into theoretically analyzing the effectiveness of the proposed VDAT method.
Acknowledgments
This work was supported by National Natural Science Foundation of China under Grant 62276175 and Innovative Research Group Program of Natural Science Foundation of Sichuan Province under Grant 2024NSFTD0035.
10

---

References
[I] Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast ad- versarial training. Advances in Neural Information Processing Systems, 33:16048-1600 2020.
[2] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In IEEE Symposium on Security and Privacy, pages 39-57. IEEE, 2017.
[3] Erh-Chung Chen and Che-Rung Lee. Data filtering for efficient adversarial training. Puttern Recognition, 151:1 151:110394, 2024.
[4] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 7766-7775. 2023.
[5] Xin Chen, Lingxi Xie, Jun Wu, and Qi Tian. Progressive differentiable architecture search: Bridging the depth gap between search and evaluation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1294-1303, 2019.
[6] Yanbo Chen and Weiwei Liu. A theory of transfer-based black-box attacks: Explanation and implications. In Advances in Neural Information Processing Systems, volume 36, pages 13887-13907, 2023.
[7] Patryk Chrabaszez, Ily Loshchilov, and Frank Hutter. A downsampled variant of imagenet as alternative to the cifar datasets. arXiv preprint arXiv: 2017.
[8] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. RobustBench: standardized adversarial robustness benchmark. In Thirty-fitth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021.
[9] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning, pages 2196-2205. PMLR, 2020.
[10] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with ensemble of diverse parameter-frea attacks. In International Conference on Machine Learning, pages 2206-2216 PMLR, 2020.
[11] Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 15721-15730, 2021.
[12] Jia Deng. Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 248-255 IEEE, 2009.
[13] Hadi M Dolatabadi, Sarah M Erfani, and Christopher Leckie. Adversarial coreset selection for efficient robust training. International Journal of Computer Vision, 131(12)3307-3331, 2023.
[14] Minjing Dong, Yanxi Li, Yunhe Wang, and Chang Xu. Adversarially robust neural architectures. 2025.
IEEE Transactions on Pattern Analysis and Machine Intelligence,
[15] Xuanyi Dong and Yi Yang. NAS-Bench-201: Extending the scope of reproducible neural architecture search. In International Conference on Learning Representations, 2020.
[16] Alhussein Fawzi, Seyed- pirical study of the topology and geometry of deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 3762-3770, 2018
Moosavi-Dezfooli: Pascal Frossard, and Stefano Soatto. Em-
[17] Yuqi Feng, Zeqiong Lx, Hongyang Chen, Shangce Gao, Fengping An, and Yanan Sun. LR- NAS: Differentiable searching for adversarially robust lightweight neural architecture. IFEE Transactions Neural Networks and Learning Systems, 36(3):5629-564) 2025.

---

[18] Yuqi Feng, Yuwei Ou, Jiahao Fan, and Yanan Sun. Zero-cost proxy for adversarial robustness evaluation, In The Thirteenth International Conference on Learning Representations, 2025.
[19] Yuqi Feng, Yanan Sun, Gary G. Yen, and Kay Chen Tan. REP: An interpretable robustness enhanced plugin for differentiable neural architecture search. IEEE Transactions on Knowledge and Data Engineering. 37(5):2888 2902, 2025.
[20] Yao Ge, Yun Li, Keji Han, Junyi Zhu, and Xianzhong Long. Advancing example exploitation can alleviate critical challenges in adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 145-154, 2023.
[21] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representations, 2015.
[22] Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When NAS meets robustness: In search of robust architectures against adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 63 631-6 2020.
[23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pages 770-778, 2016.
[24] Ramtin Hosseini, Xingyi Yang, and Pengtao Xie. DSRNA: Differentiable search of robust neural architectures. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 6 6196-6205, 2021.
[25] Zhichao Huang, Yanbo Fan, Chen Liu, Weizhong Zhang, Yong Zhang, Mathieu Salzmann, Sabine Süsstrunk, and Jue Wang. Fast adversarial training with adaptive step size. IEEE Transactions on Image Processing, 32:6102-6114, 2023.
[26] Xiaojun Jia, Yong Zhang, Xingxing Wei, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Prior-guided adversarial initialization for fast adversarial training. In European Conference Computer Vision, pages 567-584. Springer, 2022.
[27] Xiaojun Jia, Yong Zhang, Xingxing Wei, Baoyuan Wu, Ke Ma, Jue Wang. and Xiaochun Cao. Improving fast adversarial training with prior- prior-guided guided knowledge. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(9):6367-6383, 2024.
[28] Xiaojun Jia, Yong Zhang, Baoyuan Wu, Jue Wang. and Xiaochun Cao. Boosting fast adversarial training with learnable adversarial initialization. IEEE Transactions Image Processing, 31:4417-444 4430, 2022.
[29] Hamid Karimi, Tyler Derr, and Jiliang Tang. Characterizing the decision boundary of deep neural networks. arXiv preprint arXiv:1912.11466 2019.
[30] Hoki Kim, Woojin Lee, and Jaewook Lee. Understanding catastrophic overfitting in single- step adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 8119-8127, 2021.
[31] Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009.
[32] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, 2017.
[33] Shiye Lei, Fengxiang He, Yancheng Yuan, and Dacheng Tao. Understanding deep learning via decision boundary. IEEE Transactions on Neural Networks and Learning Systems, 36(1):1533 1544, 2025.
[34] Hanxiao Liu, Karen Simonyan, and Yiming Yang. DARTS: Differentiable architecture search. In International Conference on Learning Representations, 2019.
[35] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018
12

---

[36] Jisoo Mok, Byunggook Na. Hyeokjun Choe, and Sungroh Yoon. AdvRush: Searching for adversarially robust neural architectures. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 12322-12332, 2021.
[37] Guillermo Ortiz-Jimenez, Apostolos Modas, Seyed-Mohee Mohsen Moosavi, and Pascal Frossard. Hold me tight! influence of discriminative features on deep network boundaries. Advances in Neural Information Processing Systems, 23:2935-22945 2020.
[38] Yuwei Ou, Yuqi Feng, and Yanan Sun. Towards accurate and robust architectures via neural architecture search. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5967-5976, 2024.
[39] Chao Pan, Qing Li, and Xin Yao. Adversarial initialization with universal adversarial perturba- tion: A new approach to fast adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21501-21509, 2024.
[40] Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2021.
[41] Yaguan Qian, Shenghui Huang, Bin Wang, Xiang Ling, Xiaohui Guan, Zhaoquan Gu, Shaoning Zeng. Wujie Zhou, and Haijiang Wang. Robust network architecture search via feature distortion restraining. In Proceedings of the European Conference on Computer Vision, pages 122-138, 2022.
[42] Rahul Rade and Seyed-Mohsen ter accuracy vs. robustness trade-off. In International Conference on Learning Representations, 2022.
Reducing excessive margin to achieve bet-
[43] Md Farhamdur Reza, Ali Rahmati, Tianfu Wu, and Huaiyu Dai. CGBA: aurvature-aware geometric black-box attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 124-133, 2023.
[44] Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019.
[45] Kun Tong. Chengze Jiang, Jie Gui, and Yuan Cao. Taxonomy driven fast adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 5233-5242, 2024.
[46] Ruochen Wang, Minhao Cheng, Xiangning Chen, Xiaocheng Tang, and Cho-Jui Hsieh. Re- thinking architecture selection in differentiable NAS. International Conference on Learning Representations, 2021.
[47] Yulong Wang, Tong Sun, Xin Yuan, Shenghong Li, and Wei Ni. Minimizing adversarial training samples for robust image classifiers: Analysis and adversarial example generator design. IEEE Trunsuctions on Information Forensics and Security, 19:9613-9628. 2024.
[48] Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
[49] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33:2958- 2020.
[50] Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. Explor- ing and exploiting decision boundary dynamics for adversarial robustness. In International Conference Learning Representations, 2023.
[51] Yuhui Xu, Lingxi Xie, Wenrui Dai, Xiaopeng Zhang, Xin Chen, Guo-Jun Qi, Hongkai Xiong, and Qi Tian. Partially-coneected neural architecture search for reduced computational redun- dancy. IEEE Transactions on Puttern Analysis and Machine Intelligence, 43(9):2953-2970, 2021.
13

---

[52] Chris Ying, Aaron Klein, Eric Christiansen, Esteban Real, Kevin Murphy, and Frank Hutter. HAS--ench--101 Towards reproducible neural architecture search. In International Conference on Machine Learning, pages 7105-7114. PMLR, 2019.
[53] Chaojian Yu, Bo Han, Li Shen, Jun Yu, Chen Gong, Mingming Gong, and Tongliang Liu. Understanding robust overfitting of adversarial training and beyond. In International Conference on Machine Learning, pages
PMLR, 2022.
[54] Sergey Zagoruyko and Nikos Komodakis.
Wide residual networks. arXiv preprint
1605::1605.07111 2016.
[55] Arber Zela, Thomas Elsken, Tonmoy Saikia, Yassine Marrakchi, Thomas Brox, and Frank Hutter. Understanding and robustifying differentiable architecture search. In International Conference on Learning Representations, 2020.
[56] Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and aceuracy. International Conference on Machine Learning, pages 7472-7482. PMLR, 2019.
[57] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-rew reweihhte adversarial training. In International Conference on Learning Representations, 2021.
14

---

Appendix
The appendix contains contents from following aspects, order provide more insights about the proposed VDAT method:
Appendix
This section presents additional details about the methodology of VDAT.
Appendix This section contains additional details of experimental settings to facilitate the reproducibility.
Appendix C This section presents experimental results regarding robust NAS, containing the results of VDAT on CIFAR- 100 and ImageNet-IK, IK, the results in different search spaces, the results under black-box attacks, and the visualizations the search process.
This section contains additional visualizations of VDAT, i.e., the visualizations regarding the training process on ImageNet- IK and the normalized margin differences.
Appendix D
Appendix E This section presents additional results in terms of the parameter studies and ablation studies.
A More Details about the Workflow of VDAT
To help readers better understand how VDAT is integrated into robust NAS methods, we present framework of robust NAS methods along with VDAT. The workflow presented in Algorithm 2
Algorithm 2 General Workflow of Robust NAS with VDAT
Target dataset X' = {21, 22. , Fnp of epochs A for search, and the interval T
the pre pre-determined nodes and operations, the number Output: The derived robust neural architecture
Input:
Initialize the supernet based the pre-determined nodes and operations
2: Initialize the trainable weights w and architecture parameters a of the supernet
3: Divide X' into two halves, i.e., Train and X Valid
4: for = 0 to A do
5: if mod
then 6: Calculate Pu.a(z; (2,) for each sample in XTmin and Valid
7: Perform data filtering and update corresponding subsets X
Valid and Valid nat
ndv
adv
8:
end if
9:
Calculate Liain = Ctain (XTrain w. a) + Limin (XTriin .w,a) a:)
Keep the architecture parameter frozen, and update the trainable weights w based on Lusin
11: Keep the trainable weights frozen, update the architecture parameter a according to the update strategy of this robust NAS method based on Valid and VaVald
12: end for
Determine the searched architecture based on the architecture parameter a optimized
14: Return The derived robust neural architecture
As shown Algorithm given the target dataset X, along with the pre-determined nodes, operations, the number N of search epoch, and the interval T, the robust neural architecture derived finally. There are four parts (lines 3 lines 5|8 lines 9 I1 and line [3] in total in the search process. In the fist part, the supernet along with the trainable weights and the architecture parameters are initialized (lines 12). Then, the target dataset X' is equally divided into two parts, i.e., Trin and Valid for updating and a, respectively (line 3 In the second part, the data filtering is performed In the third
according to the interval T. and X Train" and A vhid are filtered respectively (lines 6 7
part, the trainable weights is updated based on training loss Liain calculated (lines TOp. Then, the architecture parameters is updated based on the update strategy of this robust NAS method (line TT). In the fourth part, the robust neural architecture is determined based on the architecture parameter optimized (line 13
15

---

B More Details of Experimental Settings
In this section, we present additional details about the experimental settings. Specifically, the details are mainly from three aspects, i.e., the experimental settings for the adversarial training, robust NAS, and evaluations.
B.1 Experimental Settings for Adversarial Training
We determine the experimental settings by following the conventions in the FAT community For the adversarial training CIFAR-I0 and CIFAR-100, the total epoch is set to 110. Meanwhile, the batch size is set to 128, the learning rate is set to 0.I, the momentum set to 0.9, and the weight decay is set to 10-1, The learning rate is decayed by the factor 0.1 at the 100-th and 105-th epochs, respectively. As for the adversarial training on ImageNer- the total epoch is set to 60. Besides, the batch size is set to 512, while the momentum, the weight decay, and the learning rate set the same values as those on CIFAR-I0 and CIFAR-100. The learning rate is decayed by the factor 0.1 at the 20-th and 40-th epochs, respectively. Please note that all the experiments are performed on the NVIDIA RTX 3090 GPU.
B.2 Experimental Settings for Robust NAS
The total number of epoch for search set to 50 for all four robust NAS methods. As for the other hyperparameters, we following the original settings of these robust NAS methods in their seminal papers 36 24 38).
B.3 Experimental Settings for Evaluations
The experimental setting for evaluations consists of two parts. The first part mainly focuses on the adversarial training of neural architectures derived by robust NAS methods. The second part mainly focuses on the settings of adversarial attacks for evaluations.
B.3.1 Settings for Training Architectures Searched
The experimental settings for the adversarial training follow the convention in the previous study [2]
19]. The PGD adversarial training is adopted to train the derived architectures (35] on CIFAR-10. 10,
CIFAR- 100, and meggeNet-16-120 77). Besides, the FGSM-based FAT method [8 adopted to
train neural architectures on ImageNet- 1K. The detailed experimental settings for adversarial training
are presented Table
Table 11: The experimental settings for the adversarial training on CIFAR-IO, CIFAR-100, ImageNet- 16-120, and ImageNet-IK.
Items
CIFAR
166-
ImageNet-IK
Optimizer
SGD
SGD
SGD
Momentum
0.9
Epochs
200
200
40
Learning Rate
0.1
0.1
0.1
Learning Rate Decay
(100, 150)
(100, 150)
(20, 30)
Weight Decay
10-4
10-4
10-4
PGD Step
FGSM
4/255
PGD
8/255
8/255
PGD Step Size
0.01
0.01
B.3.2 Settings for Adversarial Attacks
Furthermore, the experimental settings for the adversarial attacks also follow the convention
41
38
The details for the adopted FGSM 21 PGD 35 C&W (2), and AutoAttack (AA) 10 adversarial
attacks are shown in Table 12
16

---

Table 12: The experimental settings for the adversarial attacks FGSM, PGD, C&W, W. and AA.
Items
FGSM
PGD
C&W
AA
Total Perturbation Scale
8/255
8/255
8/255
Step Size
2/255
/
Steps
20, 50, 100
100
c
0.5
C Additional Experimental Results for Robust NAS
To further demonstrate the effectiveness of VDAT in the scenario of robust NAS, conduct experiments in terms of evaluations under white-box attacks, black-box attacks, different search spaces, and visualizations of the search processes. These experimental results presented in order in the following sections.
C.1 Experiments under White-box Attacks
Beyond the experimental results under white-box attacks on CIFAR-10 (Table also conduct experiments on CIFAR-100 and ImageNet-IK, to comprehensively evaluate the effectiveness of VDAT both medium--ceee scale and large-scale datasets. The robust neural architectures searched and then adversarially trained for evaluations. The experimental results on CIFAR- 100 and ImageNet- 1K are presented in Tables and 14 respectively.
Table 13: Experimental results of VDAT on CIFAR- 100 under white-box attacks. The adversarial training methods are integrated into the corresponding robust NAS methods.
Adversarial Attacks
Cost
Models
Params
Natural
FGSM
PGD (%)
PGD 100
C&W (%)
AA
(GPU Days)
DSRNA 24
2.0M
57.44
35.03
28.11
27.97
21.52
25.20
0.80
FGSM-SDI
2.0M
28.67
22.50
22.24
24.63
FGSM-PGK
27
2.8M
60.35
31.26
26.54
26.38
27.99
24.25
0.43
VDAT PGD
3.2M
63.82
38.79
31.32
30.89
24.22
28.48
0.65
FDAT
3.5M
61.02
37.41
33.31
33,07
22.12
31.42
0.34
AdvRush 36
4.2M
58.73
39.51
30.15
29.67
20.08
26.46
1.22
FGSM-SDI
FGSM-PGK A+
3.7M
61.01
31.41
25.73
25.34
24.94
24.44
0.59
VDATFOSM
3.7M
61.91
41.40
31.04
30.81
20.87
29.13
0.47
RNAS A1
3.5M
60.24
40.52
31.11
31.06
20.84
27.37
0.71
FGSM-SDI
4.4M
$9,60
30.83
24.99
23.07
0.42
+ EGSM-PGK
3.4M
59.53
32.74
26.67
26.37
28.63
25.08
0.34
VDAT PGD
VDAT
3.8M
61.07
43.21
34,60
34.37
21.62
30,82
0.27
ARNAS
4.5M
58,18
32,60
29.5 54
29.30
19.51
25.76
2.95
FGSM SDI
5.0M
62.00
32.54
26.48
26.07
24.66
24.38
1.81
FGSM-PGR PGK
3.8M
63.40
32.45
26.30
26.06
20.54
25.35
1.44
VDAT
5.7M
62,78
33.54
31.44
30.96
26.95
29.62
2.22
VDATTISM 5.0M
63.43
35,32
29.84
29.59
21.82
28.46
1.15
As can be seen from Table VDAT consistently achieves better natural accuracy compared with kate-offthhe-rt FAT methods and the baselines. Meanwhile, VDATPGD can achieve the state-of- the-art natural accuracy the cases of DSRNA and AdvRush. Moreover, after combining VDAT with robust NAS methods selected, the adversarial accuracy reaches the highest in most cases. Furthermore, VDAT also consistently achieves the lowest search cost compared with the cases of state-of-the the-trthertttt art FAT methods and vanilla robust NAS methods. In addition, the robust NAS methods integrated with VDATPGD also demonstrates better efficiency than the original ones.
As shown in Table 14 both natural accuracy and adversarial accuracy are improved after introducing VDATFGSM. These results demonstrate the effectiveness of VDAT in terms of the large-scale dataset in the scenario of robust NAS.
17

---

Table 14: The experimental results of VDAT on ImageNet-1K under white-box attacks. VDAT is
integrated into robust NAS methods.
Models
Natural (%)
FGSM (%)
PGD (%)
AA (%)
DSRNA
24
4.332
13.04
7.88
6.49
VDAT
FGSM
53.72
20.16
12.20
10.55
AdvRush
36
51.54
18.42
10.74
9.23
VDAT FGSM
54.88
21.12
12.67
11.15
RNAS 41
51.18
17.62
9.87
8.61
+ VDAT POSM
53.26
20.15
11.85
10.29
ARNAS 38
54.69
20.60
11.27
11.13
VDAT FOSM
57.05
22.68
13.14
12.90
C.2 Experiments under Black-box Attacks
To evaluate the architectures derived by robust NAS methods more comprehensively. we conduct experiments under black-box adversarial attacks beyond white-box adversarial attacks. In this set of experiments, we choose the commonly used transfer-based black-box attack [6] to further validate adversarial robustness the searched architectures. Specifically, the adversarial examples are generated based on the PGD adversarial attack, and then they are transferred attack other models. This practice follows the convention [6 38). The experimental results under the black- box attack presented in Table [5] As be seen, when VDAT is integrated into robust NAS methods, the adversarial accuracy under the black-box attack still improves, demonstrating its effectiveness under the black-box attack.
Table 15: The experimental results under the transfer-based black-box attack on CIFAR-10 and CIFAR-100. 100. The highlighted data means that the source model and the target model are the same, thus the experimental results are the same those under the white-box attack.
Target
AdyRush VDAT
RNAS
ARNAS
Datasets
Source
AdvRush
RNAS
ARNAS
VDATIGSM
VDAT
AdyRush
53:07
68.08
71.46
74.03
73.76
75.95
RNAS
68.61
53.48
66.99
72.87
70.92
74,89
ARNAS
66.90
62.22
55.87
71.51
70.05
72.86
CIFAR-10
VDATEGSM
67.43
68.88
70.41
73.18
RNAS VDATEGSM
68.40
64.65
68.52
71.69
55.43
73.42
ARNAS VDATEOSM
66.90
62.22
55.86
71.55
70.00
57.15
AdvRush
30.15
36.55
39.27
43.37
43.72
46.24
RNAS
41.55
31.11
40.22
45.61
44,83
47.47
ARNAS
41.14
36.89
29.54
45.14
44.38
46.91
CIFAR-100
AdvRush + VDATPOSM
41.03
38.06
40.89
31.04
42.77
46.23
RNAS VDATFGSM
46.50
42.16
45.16
34.60
49.18
ARNAS VDATPcSM
41.17
36.91
29.61
45.04
44.41
29.84
C.3 Experiments in Different Search Spaces
The above experimental results are all performed a classical search space the NAS community, ie.. the DARTS search space (34]. To further demonstrate the scalability of VDAT the scenario of robust NAS, we perform experiments on both NAS-Bench- 101 [52) and NAS-Bench-201 (IS) search spaces. As can be seen in Table VDAT can still bring improvements regarding both natural accuracy and adversarial accuracy in most cases. Please note that the improvement on NAS-Bench- 201 much more significant than that on MAS-Bench--11.. This because the search space of is much smaller than NAS-Bench-IDe 101, so that the architecture parameter can overfit the search data more easily. This will lead to the enrichment
the "skip connection" operation, causing the performance collapse [46.. Fortunately, VDAT can mitigate such overfitting because the data for training and search changed iteratively during the search process, thus VDAT brings significant improvements.
18

---

Table 16: Experimental results of VDAT with robust NAS methods NAS-Bench- 101 and NAS- Bench-201 benchmarks. The datasets are CIFAR-10, 10, CIFAR- 100, and ImageNet- 16-120.
NAS-Bench-100
CIFAR-10
CIFAR-100
ImageNett16-122
Models
Nat.
FGSM
PGD
AA
Nat.
FGSM
PGD
AA
Nat.
FGSM
PGD
AA
AdvRush
82.93
51.19
40.14
41.41
55.45
25.33
20.27
20.36
17.55
5.90
4.77
3.57
VDAT
85.03
56.24
47.07
46.28
58.23
30.17
25.86
24.53
17.28
7.25
6.52
3.60
RNAS [4
83.28
50.93
39,41
41.14
55.19
26.28
21.64
21.30
17.52
5.75
4.45
3.52
VVDATFOR
85.05
56.61
47,50
46.82
59.33
28.75
23.81
22.81
17.62
7.15
6,43
3,48
ARNAS
38
82.46
54.91
48.80
46.57
54.22
29.79
26.09
23.78
17.52
6.73
5.78
4.05
VVDATPOSM
84.08
55.93
47.89
46.72
56.37
29.99
26.61
24.10
17.77
7.22
6.23
4.35
NAS-Bench-201
CIFAR-10
CIFAR-100
Image
Models
Nat.
FGSM
PGD)
AA
Nat.
FGSM
PGD
AA
Nat.
FGSM
PGD
AA
AdvRush
59.31
35.58
33.26
30.94
30.17
15.52
14.71
12.65
9.58
5.30
5.13
3.47
VDAT
85.06
51.75
50.10
58.41
30.67
26.20
24.72
16.42
8.78
8.50
2.75
RNAS [4]
73.29
45.81
41.32
40.13
40.13
20.66
19.20
16.95
13.20
6.55
6.02
4.17
VDDT FOOM
82.68
56.90
49.63
47.81
55.33
28.68
24.82
23.12
17.13
8.37
7.68
4.12
ARNAS
38
79.91
54.05
48.39
46. 14
50.47
26.32
23.49
21.25
16.48
6.88
6.00
4.18
VDAATpsMM
84.84
58.56
51.19
49.41
56.95
29.90
25.74
23.75
17.48
7.28
6.57
4.75
C.4
Visualizations of the Search Process
Because the data filtering method in VDAT changes the search data iteratively in the search process, we also explore the convergence of the search to reveal the reliability of VDAT in the scenario of robust NAS. Specifically, there four indicators reported to show the convergence, i.e., the training and validation accuracy for the data in X'Irain V and the data in I'tai Vaaidd The experimental adv
nat
results are shown in Figure 6 As can be seen, all four indicators converge effectively in the search process, demonstrating that VDAT will not affect the convergence of the robust NAS methods. Please note that the indicators drop at the 40-th epoch in Figure [aal This is caused by the regularization in AdvRush and in line with the phenomenon in its original paper.
Valan Saleeyoone
Memundd Tuming (e1a
(a) AdvRush
(b) DSRNA
(c) RNAS
(d) ARNAS
Figure 6: Visualization for the search process of robust NAS methods after introducing VDAT.
Additional Visualizations for Adversarial Training
In this section, we present additional visualizations regarding the adversarial training. The visualiza- tions come from two aspects which are same as those in the main text, i.e., the training process and the vulnerability of data samples. The details are presented in the following sections.
D.1 Visualizations of the Training Process on ImageNet-1K
Beyond the visualizations of the training process on CIFAR- 1 and CIFAR-100, we also visualize the training process of VDATROSM on ImageNet- IK in Figure 7 The natural accuracy and the adversarial accuracy on the test set are visualized. The adversarial accuracy is evaluated by the PGD10 adversarial attack. As can seen from Figure even though the data for natural training and adversarial training changes during the whole training process, both natural accuracy and adversarial accuracy converge
19

---

well in the training process. More importantly, the catastrophic overfitting phenomenon also does occur in the training process on ImageNet- 1K. These observations indicate that VDAT enjoys promising convergence on the large-scale dataset, i.e., ImageNet-I K. Meanwhile, VDAT also does not suffer from the catastrophic overfitting on the large-scale dataset, demonstrating the decent reliability of VDAT.
60
Accuracy (96)
20
Clean Validation Acc
Adv Validation Acc
10
20
40
50
60
Epochs
Figure 7: Visualization of the training processes FOSM on ImageNet-
D.2 Visualizations of the Vulnerability of Data Samples
In this part, present additional visualizations of the vulnerability of data samples. Specifically, visualize the normalized margin difference (larger margin difference indicate lower vulnerability) and the corresponding number of data samples CIFAR-10 and CIFAR-100. The baseline model correlated to these results is WideRes 10 and the training method VDAT The visual- izations presented in Figure As be seen, the distribution shifts right after the training process of VDAT on both CIFAR-10 10 and CIFAR- 100. This phenomenon indicates VDAT can indeed lower the vulnerability of data samples when the baseline model is WideResNer34-10.
Training
16000
Training
After Training
After Training
Number of Samples
8000
6000
10000
Number of
8000
4000
6000
4000
2000
0.2
0.2
0.3
0.4
0.0
0.8
Normalized Margin Difference
Normalized Margin Difference
(a) CIFAR-10
(b) CIFAR- 100
Figure Visualizations of the normalized margin difference data before and after training by VDATraSM. The baseline model is WideResNNr34-100,
Besides, we also conduct the same kind of visualizations for the adversarial training method VDAT PGD in Figure 99] is obvious that the visualizations in Figure are similar to those in Figures 5 and Therefore, illustrated that VDATrap can also lower the vulnerability of data samples after training, thus the effectiveness of VDAT is further demonstrated.
E Additional Parameter Studies and Ablation Studies
In this section, we present additional parameter studies and ablation studies to further demonstrate the effectiveness of the designed components in VDAT, These results are divided into four parts, i.e., the parameter study and ablation study in the scenario of robust NAS, the ablation study regarding
20

---

1.001
Artar Telating
Kis Thamiey
Tiainiy
14:00
Tuasing
Narte Semiite
6022
Bunter
6000
100
Normal Mangl brference
Norma fred Hong laffemece
Nerma bnd Morg litheence
Nermal and Margh Getewice
ResNet (C10)
(b) WideResNet (C10)
(c) ResNet (C100)
(d) WidcResNet (C100)
Figure 9: Visualizations of the normalized margin difference of data before and after training by VDATPGD.
the adversarial loss Ladv and the natural loss Luat and the ablation study in terms of the vulnerability assessment.
E.1 Parameter Study in the Scenario of Robust NAS
In this part, we conduct the hyperparameter study for the hyperparameter T in the scenario of robust NAS. The experimental results shown in Table As can be seen, no matter which value is to, the natural accuracy and adversarial accuracy are constantly improved compared with the baseline robust NAS method DSRNA. When T is achieves the best. Therefore, the validity of our default setting of is demonstrated.
five, both natural accuracy and adversarial accuracy
Table 17: The results of the parameter study of hyperparameter 7 under robust NAS settings. The benchmark dataset is CIFAR-10, 10, and the backbone robust NAS method is DSRNA.
Params
Natural (%)
FGSM (%)
PGD (%)
DSRNA
2.0M
80.93
54.49
49.11
0.05 (x0.01)
3.6M
87.69
60.33
51.67
0.5 (x0.1)
2.8M
87.49
60.73
51.71
5 (Default)
3.4M
91.10
84.23
64.01
50 (x)
3.5M
87.51
61.42
52.62
500 (x 100)
3.4M
87.94
60.59
50.53
E.2 Ablation Study in the Scenario of Robust NAS
To validate the effectiveness of data filtering under robust NAS settings, we validate three situations in this set of experiments, the vanilla robust NAS (DSRNA), robust NAS with random filtering, and the default vulnerability-wwan data filtering in VDAT. As shown in Table [8] the random filtering can bring improvements regarding the natural accuracy and adversarial robustness of the derived architecture, but they are still inferior to the vulnerability-awar data filtering. These observations are in line with those in Table 7 In summary, the effectiveness of the vulnerability-aware data filtering is demonstrated.
Table 18: The ablation study under the robust NAS settings. The backbone robust NAS method is DSRNA, and the benchmark dataset is CIFAR-10.
Adversarial Attacks
Methods
Params
Natural (%)
FGSM (%)
2GD (%)
PGD (%)
AA (%)
DSRNA (Without Filtering)
2.0M
80.93
$4.49
49.11
48.89
44.87
VDAT (Random Filtering)
3.0M
87.52
60.66
51.68
50.90
47.45
VDAT
3.4M
91.10
84.23
64.01
54.64
50.26
E.3
Ablation Study of Ladv and Lnat
In order to validate the necessity of optimizing both Laty and Lus instead of single Lasy in Equa- conduct the ablation study regarding Ladv and Luat. In the situation of optimizing Ladv
tion g
21

---

Table 19: Ablation study regarding the natural loss Ludv and the adversarial loss ea on CIFAR- 10. The baseline model WideResNet33-100 10, and the adversarial perturbation for adversarial training generated by PGD adversarial attack.
add
Lax
Natural (%)
PGD (%)
Cost
79.99
55.00
8.67
88.10
60.26
9.77
individually, we directly remove the data samples filtered for natural training, and only train the model with samples filtered for adversarial training. The experimental results are shown in Table [9] As can be seen, when optimizing fadv individually, both natural accuracy and adversarial accuracy drop. This is mainly because the useful features which are contained by data samples filtered for natural training removed, thus the overall performance is negatively affected. Moreover, the training cost decreases slightly when removing Leat. this is because the natural training process is removed. However, because the natural training does not cost much computational budget, still choose to optimize Ladv and Lat at the same time to ensure the promising natural accuracy and adversarial accuracy.
E.4 Ablation Study of the Vulnerability Assessment
This set experiments consists of two parts. First, we evaluate different types margins for vulnerability assessment under the non-targeted adversarial attacks. Second, we compare different adversarial attacks for the vulnerability assessment.
In the first part, we evaluate the pure margin (shown in Equation 2 and the soft margin under the non non-targeted adversarial attacks. The benchmark datasets are CIFAR-10 and CIFAR-100, and the baseline model for adversarial training is ResNet18. As shown in Table 20 both natural accuracy and adversarial accuracy decrease when changing the soft margin to the pure margin. Consequently, the proposed margin-bas bargin-based vulnerability calculation method is shown to be effective under non-targeted adversarial attacks.
Table 20: Ablation study regarding different types of margins for vulnerability assessment. The adversarial attacks are con-targeted attacks.
Datasets
Margins
Natural (%)
FGSM (%)
PGD (%)
PGD (%)
CIFAR-10
Pure Margin
84.53
58.61
52.30
52.16
CIFAR-10 10
Soft Margin
86.32
62.94
56.30
56.23
CIFAR-100
Pure Margin
58.36 59.43
37.74
27.58
27.46
CIFAR-100
Soft Margin
41.17
35.69
35.61
Table 21: Ablation study regarding different adversarial attacks for vulnerability assessment. The loss for adversarial training the PGD loss.
Perturbation
Natural (%)
PGD (%)
Cost (GPU Hours)
1G
82.15
58.35
3.04
2GD
81.99
58.80
3.75
FGSM
82.96
56.07
1.96
In the second part, evaluate PGD 10 PGD20, and FGSM adversarial attacks for vulnerability assessment. Different from the FGSM training loss adopted in Table g this set of experiments adopts PGD training loss for comprehensive evaluation. As shown in Table 21 using stronger attacks (i.e., PG and 2GD for vulnerability assessment can increase the adversarial accuracy. However, this will also decrease the natural accuracy and training efficiency. Considering the balance of natural accuracy, adversarial accuracy, and training cost, we choose FGSM as the default attack for vulnerability assessment.
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The claims made in the abstract and introduction indeed reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The limitations mainly lie in the limited transferability in terms of LLMs.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
23

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
The detailed experimental settings included.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
24

---

Answer:
[Yes]
Justification:
The data and code will be publicly available.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ /pipps.ccppullc//uuuii wwwtii/gguie///eeeeceoocc CoodeSubeiiie ssi wsionnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
The detailed experimental settings are provided.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We have reported the mean and standard deviation in our experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
25

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The computer resources are reported.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that NeurIPS Code of Ethics https: //t::://neuiis.eeeeee httpp////l///ccc/cccciielllellee
didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the
Answer: [Yes]
Justification:
The research strictly follows the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: This work provides novel perspectives for fast adversarial training.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to
26

---

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative socictal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: The paper faces no threat of safety.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The original papers of the datasets used are all properly cited.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwppppsiipteeeee www.ree.wthhhe....c. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's is creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
27

---

Answer:
[NA]
Justification:
There is no new assets in this work.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This is no crowdsourcing experiments or research with human subjects this paper.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Bthies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for rescarch with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not include study participants.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMSs if it is an important, original, or non-standard component of the methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is required.
Answer: [NA]
28

---

Justification:
No LLM usage in this work.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy httees////earrppcccc////f/rreerp for what should or should not be described.
29


Reviews:
[{"review_id": "nlEcToXaPs", "reviewer": "Reviewer_JUYs", "summary": "This paper proposes modifying fast adversarial training (FAT) methods by making it more probable to train on adversarial examples for vulnerable training examples, creating vulnerable data-aware adversarial training (VDAT). The vulnerability of a training example is evaluated by computing the difference between the margin between the clean training example and the decision boundary and the margin between a generated adversarial example and the decision boundary. In order to have this margin account for decision boundaries for multiple classes, the paper proposes a soft margin. The probability of training on a generated adversarial example is then computed, with adversarial examples corresponding to training examples that are more vulnerable than average being more likely to be selected for use for a training parameter update. Experiments on CIFAR-10, CIFAR-100, and ImageNet-1K show that the proposed method outperforms previous methods in both natural accuracy and robust accuracy. Additional evidence for the quality of the proposed method is given by showing that combining it with neural architecture search (NAS) also leads to performance improvement.", "questions": "Line 174: Should R(0,1) denote a uniform random value ranged from zero to one?\n\nWhat do the authors see as the value added by Proposition 4.2?", "limitations": "The big limitation of the method appears to be that it slows down FAT. This is discussed in the paper.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Quality: This paper seems to be technically sound and the proposed methods appear to be properly applied. The claims seem to be supported by the experimental results. \n\nClarity: The paper is clear.\n\nSignificance: The proposed method is of interest to those that want to use adversarial training for developing more robust networks.\n\nOriginality: The proposed method is, to my knowledge, novel.", "was_revised": true, "final_justification": "The paper covers a novel approach to adversarial training that focuses on vulnerable examples. The approach is thoroughly evaluated and appears to have better results than previous methods.", "rebuttal": "Thank you sincerely for the recognition in our work. We appreciate your great effort and answer your questions in detail below.\n\n> **Q1: Line 174: Should $\\mathcal{R}(0,1)$ denote a uniform random value ranged from zero to one?**\n\nYes, $\\mathcal{R}(0,1)$ denotes a uniform random value ranged from zero to one. The aim of adopting the uniform distribution is to ensure that the probability of adding adversarial noise is exactly $\\mathcal{P}_{\\theta}(x_i)$. We will add the claim in terms of the uniform random value in line 174 in our next version, to make the description clearer.\n\n> **Q2: What do the authors see as the value added by Proposition 4.2?**\n\nThe value of Proposition 4.2 is that it can theoretically show the effectiveness of the proposed training loss. Specifically, Proposition 4.2 can show that training with the loss in Equation (8) can lower the upper bound of the adversarial loss. Because the lower upper bound leads to better adversarial robustness, it is theoretically demonstrated that the proposed training loss can enhancing the adversarial robustness.\n\nHowever, as stated by Reviewer 25Wa, the current version of the theoretical analysis is still not complete in terms of the definitions, assumptions, and proofs. To avoid misleading readers, we decide to remove the theoretical claims including Proposition 4.2 in the current version. In the future, we will give a rigorous proof regarding the linear classifiers at the first step, and then conduct theoretical analysis for the deep neural networks based on the findings in the first step. We are actively working on the first step and hope to be able to present it as a complete but separate study real soon."}, {"review_id": "LDro5zfn0M", "reviewer": "Reviewer_MotY", "summary": "The authors introduce vulnerable data-aware adversarial training (VDAT) to improve the efficiency and effectiveness of fast adversarial training (FAT). The authors measure the vulnerability by computing the difference of decision margin for clean and adversarial examples, and then update the clean and adversarial training dataset by using adversarial examples of vulnerable examples in the training process. Extensive experiments validate the effectiveness of the proposed approach in different tasks, datasets and models.", "questions": "1. What are the performance when replacing the vulnerability calculation, e.g. using the pure margin, or changing the margin calculation?\n2. Can the proposed VDAT combine with other multi-step or single-step adversarial training frameworks like AWP and TRADES and further improve their performance?\n3. Can the proposed method be extended to other tasks apart from image classification? If so, how to measure the vulnerability and design the data filtering approach?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The proposed approach is clear elaborated with detailed procedure for each step of adversarial training, ensuring the reproducibility.\n2. The paper focus on the critical issue in adversarial training, and propose an effective measurement for vulnerability of adversarial examples.\n3. Extensive experiments are conducted through various tasks, datasets and models, and consistent improvement is achieved in all the experiments, validating the effectiveness of the proposed method. \n\nWeaknesses:\n\n1. The effectiveness of the proposed margin-based vulnerability calculation compared with other measurement is not fully explored by experimental results.\n2. The proposed VDAT seems to be a plug-and-play method in multiple adversarial training frameworks. However, there lacks experiments for combining VDAT with other frameworks like AWP, TRADES and etc.", "was_revised": true, "final_justification": "The author addressed my questions, and I believe the novelty of this paper deserves the attention of the conference audience.", "rebuttal": "We sincerely thank you for the time and effort you have invested in reviewing our paper. Your comments and questions are very insightful and highly valuable for us to enhance the paper. Your comments are addressed point-by-point in the following.\n\n> **W1 & Q1: The effectiveness of the proposed margin-based vulnerability calculation compared with other measurement (e.g., pure margin) is not fully explored by experimental results.**\n\nThank you for pointing this out. To demonstrate the effectiveness of the proposed margin-based vulnerability calculation method based on soft margin, we have conducted experiments in terms of the soft margin and pure margin. Specifically, the calculation of the pure margin is shown in Equation (2) in the paper. The benchmark datasets are CIFAR-10 and CIFAR-100, and the deep neural network for adversarial training is ResNet18. As shown in the table below, both natural accuracy and adversarial accuracy decrease when changing the soft margin to the pure margin. Consequently, the proposed margin-based vulnerability calculation method is shown to be effective.\n\n|Datasets|Measurements|Natural (%)|FGSM (%)|PGD20 (%)|PGD50 (%)|\n|-|-|-|-|-|-|\n|CIFAR-10|Pure Margin|84.53|58.61|52.30|52.16|\n|CIFAR-10|Soft Margin (VDAT)|**86.32**|**62.94**|**56.30**|**56.23**|\n|CIFAR-100|Pure Margin|58.36|37.74|27.58|27.46|\n|CIFAR-100|Soft Margin (VDAT)|**59.43**|**41.17**|**35.69**|**35.61**|\n\n> **W2 & Q2: There lacks experiments for combining VDAT with other adversarial training frameworks like AWP and TRADES.**\n\nThank you for the insightful comment. We have integrated VDAT into AWP and TRADES to perform adversarial training. In this set of experiments, the benchmark dataset is CIFAR-10 and the deep neural network for training is ResNet18. The natural accuracy, adversarial accuracy, and training cost are reported in the table below. As can be seen, VDAT can improve the natural accuracy and adversarial accuracy of both TRADES and AWP. Meanwhile, the training cost of both TRADES and AWP is decreased owing to the integration of VDAT. In summary, VDAT is shown to be effective in improving the performance of AWP and TRADES.\n\n|Methods|Natural (%)|FGSM (%)|PGD20 (%)|PGD50 (%)|Cost (GPU Hours)|\n|-|-|-|-|-|-|\n|TRADES|81.16|60.27|52.45|52.39|6.44|\n|TRADES + VDAT|**81.43**|**61.15**|**55.55**|**55.50**|**3.27**|\n|AWP|81.97|58.47|53.98|53.91|7.15|\n|AWP + VDAT|**83.97**|**62.32**|**56.03**|**55.93**|**3.76**|\n\n> **Q3: Can the proposed method be extended to other tasks apart from image classification? If so, how to measure the vulnerability and design the data filtering approach?**\n\nYes, it can. We have shown that the proposed method can be extended to the node classification task. In this task, the vulnerability is still measured by the difference of the soft margin. Specifically, we denote the clean graph and the perturbed graph as $x$ and $x'$, and the output logit for class $c$ as $\\phi_{\\theta}^{c}(x_i)$, where $\\theta$ denotes the parameters of GNN, and $x_i$ denotes the $i$-th node in the graph $x$. Giving the node $x_i$ and its label $y_i$, the soft margins of $x_i$ in $x$ and $x_i'$ in $x'$ are calculated by Equations (3) and (4) based on $\\phi_{\\theta}^{c}(x_i)$ and $\\phi_{\\theta}^{c}(x_i')$. Finally, the vulnerability of node $x_i$ is determined by Equation (5) based on the soft margins calculated.\n\nFor the data filtering, we calculate the probability of adversarial training for each node based on Equation (6), where the vulnerability values are determined in the previous steps. According to the probability calculated, we can divide the nodes for training into two sets, i.e., $X_{adv}$ and $X_{nat}$. The nodes in $X_{adv}$ are forward to the PGD attack to change their corresponding edges. Then, the GNN is trained based on the nodes in $X_{adv}$ and $X_{nat}$.\n\nWe have conducted experiments on both Cora and CiteSeer datasets with the vanilla GCN. The PGD and Min-Max adversarial attacks are implemented based on the previous study [1] with the perturbation rate of 20%. As can be seen from the table below, the proposed VDAT method can still improve the natural accuracy and adversarial accuracy while decrease the training cost.\n\n|Datasets|Methods|Natural (%)|PGD (%)|Min-Max (%)|Cost (GPU Hours)|\n|-|-|-|-|-|-|\n|Cora|PGD Train|79.00|61.00|**15.60**|0.41|\n|Cora|PGD Train + VDAT|**79.90**|**62.70**|15.10|**0.25**|\n|CiteSeer|PGD Train|69.00|52.80|8.50|0.77|\n|CiteSeer|PGD Train + VDAT|**71.70**|**54.00**|**8.80**|**0.46**|\n\n**Reference**\n\n[1] Topology attack and defense for graph neural networks: An optimization perspective, IJCAI 2019."}, {"review_id": "uzVb0qbVdS", "reviewer": "Reviewer_sLg7", "summary": "The paper introduces Vulnerable Data-aware Adversarial Training (VDAT), a novel approach to fast adversarial training (FAT) by focusing on sample-wise data filtering rather than the traditional batch-wise methods, which can improve natural accuracy and adversarial accuracy while reducing adversarial training cost.", "questions": "1. Could you please explain the significant accuracy improvement observed around epoch 100 in Figure 4?\n2. Could you please explain why VDAT_FGSM generally performs better than VDAT_SGD on both natural accuracy and adversarial accuracy? This seems a bit counterintuitive to me, since SGD provides stronger adversarial examples.\n3. The vulnerability calculation relies on an initial perturbation generated by a single-step FGSM attack for efficiency. How sensitive are the results to this choice? Specifically, if a stronger (e.g., PGD) but more costly attack was used to assess vulnerability, would it identify a more correct set of vulnerable samples and lead to a more robust final model, even if the training itself still uses FGSM or PGD?\n4. Scalability to Large Datasets: The paper reports a time complexity of O(n*k). While the proposed algorithm demonstrates feasibility on smaller datasets, its performance on truly large-scale datasets (e.g., ImageNet-21K) remains unclear, as the sample-wise approach may introduce significant computational overhead. Could the authors provide:\n  - Profiling results detailing the actual runtime breakdown (e.g., percentage of time spent on vulnerability calculation vs. model training)   \n  - Empirical or simulated training overhead analysis to demonstrate how the method would scale to larger datasets.", "limitations": "No. See the contents in Questions.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- (S1) The paper addresses the critical problem of the high computational cost of adversarial training. The proposed VDAT method offers a solution that not only achieves a remarkable speedup (up to 76% efficiency improvement)  but also improves the final model's natural and adversarial accuracy. \n- (S2) The paper is exceptionally well-written and clearly structured.\nWeakness:\n- (W1) This paper has a strong experimental evaluation. However, the study could be further strengthened by incorporating adversarial training experiments on larger-scale datasets, as the benefits of the proposed algorithm may diminish in such scenarios.\n- (W2) Additional experiments and analyses would be beneficial to better understand the algorithm's performance characteristics, particularly regarding how its effectiveness varies with different attack methods for vulnerability assessment.", "was_revised": true, "final_justification": "The author‘s additional experiments and clarifications are appreciated. However, some concerns—particularly regarding large-scale evaluation and robustness across attack settings—remain partially unresolved. I will keep my original score as 4.", "rebuttal": "We are immensely grateful for your effort in reviewing our work, as well as for your constructive suggestions and insightful questions. In the following, we will address each of your concerns point-by-point.\n\n> **W1 & Q4: Adversarial training experiments on ImageNet-21K in terms of profiling results detailing the actual runtime breakdown and empirical or simulated training overhead analysis.**\n\nThank you for the nice suggestion. We address your concern from the following two aspects.\n\n+ **Profiling results detailing the actual runtime breakdown:** Due to the limitations of computational resources, the complete training of 60 epochs on ImageNet-21K will take more than 17 days, and we are sorry for not being able to provide those results in the rebuttal period. Instead, we perform VDAT along with the FGSM-based adversarial training to train ResNet50 for 10 epochs on ImageNet-21K. As shown in the table below, the time breakdown on ImageNet-21K is similar to that on ImageNet-1K. These results demonstrate that VDAT does not significantly increase the time proportion of the vulnerability calculation when the scale of the data becomes larger.\n\n|Dataset & Epochs|Vulnerability Calculation|Model Training|\n|-|-|-|\n|ImageNet-21K, Epoch=10|17.99%|82.01%|\n|ImageNet-1K, Epoch=10|17.47%|82.53%|\n|ImageNet-1K, Epoch=60|17.78%|82.22%|\n\n+ **Empirical or simulated training overhead analysis:** We compare the training cost of FGSM-PGK [1] and the proposed VDAT method on ImageNet-21K. Both methods are performed to train ResNet50 for 10 epochs. As can be seen from the table below, VDAT is more efficient than FGSM-PGK. Consequently, it is demonstrated that the proposed VDAT method is still efficient on the large-scale dataset.\n\n|Methods|Cost (GPU Hours)|\n|-|-|\n|FGSM-PGK|78.53|\n|VDAT|72.66|\n\n> **W2 & Q3: It is unclear how the effectiveness of VDAT varies with different attack methods for vulnerability assessment. Would a stronger attack (e.g., PGD) lead to a more robust final model, even if the training itself still uses FGSM or PGD?**\n\nThe stronger attack for vulnerability assessment can lead to a more robust final model, but it lowers the natural accuracy and increases the training cost. Specifically, we have conducted experiments on CIFAR-10 to train ResNet18 with different training losses, i.e., FGSM and PGD. Meanwhile, the adversarial attack for vulnerability assessment are changed from the default FGSM to PGD10 and PGD20. As can be seen from the table below, using stronger attacks for vulnerability assessment can increase the adversarial accuracy. However, this will also decrease the natural accuracy and training efficiency. Considering the balance of natural accuracy, adversarial accuracy, and training cost, we choose FGSM as the default attack for vulnerability assessment.\n\n|Training Loss|Vulnerability Assessment|Natural (%)|PGD50 (%)|Cost (GPU Hours)|\n|-|-|-|-|-|\n|FGSM|PGD10|85.96|58.03|1.10|\n|FGSM|PGD20|85.96|**58.50**|1.34|\n|FGSM|FGSM|**86.32**|56.23|**1.04**|\n\n|Training Loss|Vulnerability Assessment|Natural (%)|PGD50 (%)|Cost (GPU Hours)|\n|-|-|-|-|-|\n|PGD|PGD10|82.15|58.35|3.04|\n|PGD|PGD20|81.99|**58.80**|3.75|\n|PGD|FGSM|**82.96**|56.07|**1.96**|\n\n> **Q1: Could you please explain the significant accuracy improvement observed around epoch 100 in Figure 4?**\n\nThe significant accuracy improvement is caused by the decay of learning rate. Specifically, the learning rate is decayed with the factor of 0.1 at the 100-th and 105-th epochs. This practice follows the convention of adversarial training [2].\n\n> **Q2: Could you please explain why VDAT_FGSM generally performs better than VDAT_PGD on both natural accuracy and adversarial accuracy? This seems a bit counterintuitive to me, since PGD provides stronger adversarial examples.**\n\nThank you for the insightful question. We answer your question from the following two aspects.\n\nIn the case of adversarial training, we would like to argue that VDAT_FGSM performs better than VDAT_PGD on natural accuracy and weak adversarial attacks, while VDAT_FGSM is not as good as VDAT_PGD on stronger attacks. As shown in Table 1, VDAT_FGSM outperforms VDAT_PGD in terms of natural accuracy and adversarial accuracy under FGSM attack. As for the stronger adversarial attacks, i.e., C&W and AA, VDAT_PGD often performs better than VDAT_FGSM. This is mainly because VDAT_PGD provides stronger adversarial examples, and learning these adversarial examples can help the model achieve better accuracy under stronger adversarial attacks. However, it is shown that stronger adversarial examples can lead to robust overfitting of the strong adversarial perturbations [3]. As a result, the model suffers from the poor generalizability to the clean data and weak adversarial examples, thus the natural accuracy and adversarial accuracy on weak adversarial attacks become lower.\n\nIn the case of robust neural architecture search (NAS) in Table 4, the phenomenon mentioned by the reviewer is mainly caused by the overfitting phenomenon of the supernet. Specifically, VDAT_PGD will cause robust overfitting more easily than VDAT_FGSM during the training process of the supernet [3]. As indicated in the previous study [4], the overfitting can make the NAS algorithm add more parameter-free operations (e.g., skip connection) to the derived architecture. As a result, the architectures searched with VDAT_PGD demonstrate lower natural accuracy and adversarial accuracy than those searched with VDAT_FGSM.\n\n**References**\n\n[1] Improving fast adversarial training with prior-guided knowledge, TPAMI 2024.\n\n[2] Boosting fast adversarial training with learnable adversarial initialization, TIP 2022.\n\n[3] Understanding robust overfitting of adversarial training and beyond, ICML 2022.\n\n[4] Understanding and robustifying differentiable architecture search, ICLR 2020."}, {"review_id": "ei4EEEyf14", "reviewer": "Reviewer_25Wa", "summary": "This paper addresses the efficiency of fast adversarial training (FAT) by proposing vulnerable data-aware adversarial training (VDAT), which employs sample-wise data filtering rather than the batch-wise filtering used in existing FAT methods. Building on prior research showing that certain samples contribute minimally to adversarial robustness, the authors propose prioritizing vulnerable samples during training to achieve faster convergence. The filtering mechanism relies on a margin-based vulnerability metric defined through soft margins considering all classes, which quantifies the model's vulnerability to specific samples.", "questions": "I find the proposed method and experimental results satisfactory and believe they contribute meaningfully to the field. These contributions would be valuable even without theoretical guarantees. However, as noted in the weaknesses section, I am concerned that the paper contains clear errors or overclaiming in its theoretical analysis, which could mislead readers. If the authors provide a clear commitment to addressing these theoretical issues, I would be willing to raise my rating to Accept.", "limitations": "Yes, but the authors addressed only a few in the checklist.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\nThe paper presents a simple and intuitive concept of sample-wise data filtering using margins, which offers high compatibility with various adversarial example generation methods and demonstrates good generalizability. The proposed method shows superior performance compared to existing approaches in terms of both speed and accuracy. The experimental setup is generally comprehensive and well-designed.\n\n**Weaknesses**\n\n**1. Effectiveness of soft margin and temperature parameter $\\tau$**\n\nWhile the paper introduces the soft margin and temperature parameter $\\tau$ to enhance robustness against targeted attacks, the ablation study in Table 5 does not clearly demonstrate whether these components actually improve effectiveness against targeted attacks as intended.\n\n**2. Theoretical analysis contains errors or lacks clarity**\n\nI believe the theoretical analysis section requires substantial revision or removal. The analysis suffers from insufficient assumptions and unclear explanations in the proofs, making it difficult to assess the validity of the theoretical claims.\n\nLemma 4.1 lacks necessary assumptions. While $f_θ$ is described as \"a deep neural network,\" the specific definition remains unclear. If any classifier is acceptable, it should be written as a general function as shown in line 114. If it must be a neural network, the architecture should be explicitly specified. Although this is borrowed from [48], as required by NeurIPS Checklist 3, it should be formally provided within this paper. Additional details such as the parameter update method for $\\theta$ (gradient descent? flow? [48] may use gradient flow) and the domain and conditions for $x$ and $y$ should also be clarified.\n\nUpon reviewing the proof in [48], I found that their proof relies on Assumption 5.1, which you must also reference in your paper. Unfortunately, this assumption is not explicitly stated in the arXiv version of [48], making it impossible for me to infer its content. At minimum, this appears to involve positive eigenvalues of the Gram matrix, which is neither a simple nor obvious assumption and likely requires strong constraints such as infinite width for neural network architectures. Data assumptions such as spherical distributions may also be necessary. Please refer to neural tangent kernel literature.\n\nProposition 4.2 also contains vague statements such as \"Training the target model based on datasets $X_{nat}$ and $X_{adv}$.\" In an extreme case, even \"training\" with a loss function $\\ell(x, y) = 0$ would be included under this description, yet your claim would not hold in such cases.\n\nAdditionally, the proof in Appendix B relies heavily on verbal explanations rather than mathematical formulations, making it difficult to follow. I would appreciate specific references to the relevant sections in [48] where equation (11) is mentioned, as well as mathematical formulations for the operations described in lines 508-512. The mathematical derivations leading to the conclusion should be more explicitly stated.\n\nIn summary, to support Lemma 4.1 and Proposition 4.2, you should provide detailed definitions of the network architecture and parameter update methods, along with accurate references to all assumptions used, as required by NeurIPS Checklist 3. These clarifications may necessitate substantial rewriting of the proofs.\n\nGiven recent theoretical research in adversarial training, proving the theoretical effectiveness of this loss function for deep neural networks appears extremely challenging and would likely require dozens of pages of rigorous proof. Proofs for linear classifiers or at most two-layer networks would be more realistic in scope.\n\nBased on these concerns, I recommend either:\n\n- Substantial revision of the theorem statements, claims, and proofs, along with review of potentially overclaimed statements (e.g., lines 11, 12, 66).\n- Removal of the theoretical claims entirely.\n\n**Minor Comments**\n\n- Line 115: Missing braces {}.\n- The notation V_{x_i} and V_θ(x_i) are used inconsistently throughout the text (e.g., around line 131) and should be unified.\n- In Algorithm 1, the model parameter θ may be missing from the input and output specifications.", "was_revised": true, "final_justification": "As my concerns have been addressed, and as stated in my earlier review, I am increasing my score from 3 to 5.", "rebuttal": "Thank you greatly for dedicating your time and expertise to reviewing our paper. Your comments and suggestions are truly helpful to enhance our paper and have pointed out the direction of our future work. Please see our response below.\n\n> **W1: Effectiveness of soft margin and temperature parameter $\\tau$ against targeted attacks.**\n\nThank you for pointing this out, and we have conducted experiments to show the effectiveness of soft margin and temperature parameter $\\tau$ against targeted attacks. Specifically, we train ResNet18 on CIFAR-10 with the pure margin (Equation (2)) and the soft margin with different values of $\\tau$. For evaluation, the targeted adversarial attacks are variants of the PGD attack, i.e., PGD_Random and PGD_Least_Likely. PGD_Random indicates that the target labels are chosen randomly. PGD_Least_Likely indicates that the target label is the label corresponding to the smallest output logit. Both strategies for selecting target labels are designed following the convention [1]. As shown in the table below, the adversarial accuracy under targeted attacks increases when the pure margin is changed to the soft margin. Consequently, the soft margin is shown to be effective to improve the adversarial accuracy under the targeted adversarial attack. Moreover, when the temperature parameter $\\tau$ is set to five, the adversarial accuracy becomes the highest, demonstrating the validity of setting $\\tau$ to five as default.\n\n|Method|Natural (%)|PGD20_Random (%)|PGD50_Random (%)|PGD20_Least_Likely (%)|PGD50_Least_Likely (%)|\n|-|-|-|-|-|-|\n|Pure Margin|84.53|56.21|56.04|75.45|75.24|\n|Soft Margin ($\\tau$=0.05)|85.88|63.28|63.20|77.84|77.65|\n|Soft Margin ($\\tau$=0.5)|85.96|69.32|68.86|82.07|81.94|\n|Soft Margin ($\\tau$=1)|85.88|70.00|69.31|82.06|81.84|\n|Soft Margin ($\\tau$=5)|**86.32**|**72.75**|**72.35**|**83.31**|**83.28**|\n|Soft Margin ($\\tau$=50)|86.25|71.20|70.61|82.20|82.02|\n|Soft Margin ($\\tau$=500)|**86.32**|69.55|69.53|80.75|80.44|\n\n> **W2: Theoretical analysis.**\n\nWe sincerely appreciate your meticulous review. Following your suggestion, we promise to remove the theoretical claims entirely in the next version of this work. Specifically, we will remove or change the following contents:\n\n+ Remove the descriptions about the theoretical analysis in Abstract (lines 11-12).\n\n+ Remove the claim about the theoretical analysis in Introduction (line 66).\n\n+ Remove contents of the theoretical analysis in Section 4.3 (lines 201-213).\n\n+ Remove the descriptions of the proofs in Appendix B (lines 468-469).\n\n+ Remove the whole contents about theoretical analysis and proofs in Appendix B (lines 493-515).\n\n+ Change the answer in line 709 of NeurIPS Paper Checklist 3 to [NA], and the justification in line 710 to \"The paper does not include theoretical results\".\n\nFurthermore, we are actively working towards providing a rigorous proof regarding the effectiveness of the proposed VDAT method. Specifically, we will provide the whole set of assumptions in terms of the constraints for the network architecture, the parameter update method, the domain and conditions of the input data and labels, and the positive eigenvalues of the Gram matrix. Besides, the corresponding definitions about the network architecture and update methods, along with formulated proofs will be also provided. Thanks again for your valuable suggestions, and we hope to present a rigorous theoretical analysis in terms of the linear classifier as a complete but separate study real soon.\n\n> **W3: Line 115: Missing braces {}.**\n\nWe will change \"1,2,...,k\" in the subscript to \"{1,2,...,k}\" in line 115. \n\n> **W4: The notation V_{x_i} and V_θ(x_i) are used inconsistently throughout the text (e.g., around line 131) and should be unified.**\n\nWe will change the symbol $V_{x_i}$ in line 131 to $V_{\\theta} (x_i)$ for uniformity. Moreover, the symbols $V_{x_i}$ and $P_{x_i}$ in Figure 3 will be also changed to $V_{\\theta} (x_i)$ and $P_{\\theta} (x_i)$, respectively.\n\n> **W5: In Algorithm 1, the model parameter θ may be missing from the input and output specifications.**\n\nWe will change \"the target model\" in Input to \"the target model with parameter $\\theta$\", and \"The trained model\" in Output to \"The trained model with parameter $\\theta*$\". Besides, the words \"The trained model with $\\theta$\" in line 9 of Algorithm 1 will be changed to \"The trained model with $\\theta*$\".\n\n**Reference**\n\n[1] Adversarial machine learning at scale, ICLR 2017."}]

Author rebuttal:

Meta-review: This paper introduces Vulnerable Data-Aware Adversarial Training (VDAT), an effective method for enhancing the efficiency and effectiveness of Fast Adversarial Training (FAT). The work makes a significant and valuable contribution to the adversarial robustness community. It is generally well-written, with a clearly articulated motivation and methodology. The authors have also done an excellent job addressing the reviewers' concerns. For these reasons, I believe this paper would be a valuable addition to the NeurIPS program and argue for its acceptance.
Decision: Accept (poster)