Title: Vulnerable Data-Aware Adversarial Training
Venue: NeurIPS 2025
Accepted: yes
Keywords: Adversarial Training

Adversarial Robustness

Decision Boundary Analysis
Abstract: Fast adversarial training (FAT) has been considered as one of the most effective alternatives to the computationally-intensive adversarial training. Generally, FAT methods pay equal attention to each sample of the target task. However, the distance between each sample and the decision boundary is different, learning samples which are far from the decision boundary (i.e., less important to adversarial robustness) brings additional training cost and leads to sub-optimal results. To tackle this issue, we present vulnerable data-aware adversarial training (VDAT) in this study. Specifically, we first propose a margin-based vulnerability calculation method to measure the vulnerability of data samples. Moreover, we propose a vulnerability-aware data filtering method to reduce the training data for adversarial training thus improve the training efficiency. The experiments are conducted in terms of adversarial training and robust neural architecture search on CIFAR-10, CIFAR-100, and ImageNet-1K. The results demonstrate that VDAT is up to 76% more efficient than state-of-the-art FAT methods, while achieving improvements regarding the natural accuracy and adversarial accuracy in both scenarios. Furthermore, the visualizations and ablation studies show the effectiveness of both core components designed in VDAT.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the efficiency of fast adversarial training (FAT) by proposing vulnerable data-aware adversarial training (VDAT), which employs sample-wise data filtering rather than the batch-wise filtering used in existing FAT methods. Building on prior research showing that certain samples contribute minimally to adversarial robustness, the authors propose prioritizing vulnerable samples during training to achieve faster convergence. The filtering mechanism relies on a margin-based vulnerability metric defined through soft margins considering all classes, which quantifies the model's vulnerability to specific samples.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\nThe paper presents a simple and intuitive concept of sample-wise data filtering using margins, which offers high compatibility with various adversarial example generation methods and demonstrates good generalizability. The proposed method shows superior performance compared to existing approaches in terms of both speed and accuracy. The experimental setup is generally comprehensive and well-designed.\n\n**Weaknesses**\n\n**1. Effectiveness of soft margin and temperature parameter $\\tau$**\n\nWhile the paper introduces the soft margin and temperature parameter $\\tau$ to enhance robustness against targeted attacks, the ablation study in Table 5 does not clearly demonstrate whether these components actually improve effectiveness against targeted attacks as intended.\n\n**2. Theoretical analysis contains errors or lacks clarity**\n\nI believe the theoretical analysis section requires substantial revision or removal. The analysis suffers from insufficient assumptions and unclear explanations in the proofs, making it difficult to assess the validity of the theoretical claims.\n\nLemma 4.1 lacks necessary assumptions. While $f_θ$ is described as \"a deep neural network,\" the specific definition remains unclear. If any classifier is acceptable, it should be written as a general function as shown in line 114. If it must be a neural network, the architecture should be explicitly specified. Although this is borrowed from [48], as required by NeurIPS Checklist 3, it should be formally provided within this paper. Additional details such as the parameter update method for $\\theta$ (gradient descent? flow? [48] may use gradient flow) and the domain and conditions for $x$ and $y$ should also be clarified.\n\nUpon reviewing the proof in [48], I found that their proof relies on Assumption 5.1, which you must also reference in your paper. Unfortunately, this assumption is not explicitly stated in the arXiv version of [48], making it impossible for me to infer its content. At minimum, this appears to involve positive eigenvalues of the Gram matrix, which is neither a simple nor obvious assumption and likely requires strong constraints such as infinite width for neural network architectures. Data assumptions such as spherical distributions may also be necessary. Please refer to neural tangent kernel literature.\n\nProposition 4.2 also contains vague statements such as \"Training the target model based on datasets $X_{nat}$ and $X_{adv}$.\" In an extreme case, even \"training\" with a loss function $\\ell(x, y) = 0$ would be included under this description, yet your claim would not hold in such cases.\n\nAdditionally, the proof in Appendix B relies heavily on verbal explanations rather than mathematical formulations, making it difficult to follow. I would appreciate specific references to the relevant sections in [48] where equation (11) is mentioned, as well as mathematical formulations for the operations described in lines 508-512. The mathematical derivations leading to the conclusion should be more explicitly stated.\n\nIn summary, to support Lemma 4.1 and Proposition 4.2, you should provide detailed definitions of the network architecture and parameter update methods, along with accurate references to all assumptions used, as required by NeurIPS Checklist 3. These clarifications may necessitate substantial rewriting of the proofs.\n\nGiven recent theoretical research in adversarial training, proving the theoretical effectiveness of this loss function for deep neural networks appears extremely challenging and would likely require dozens of pages of rigorous proof. Proofs for linear classifiers or at most two-layer networks would be more realistic in scope.\n\nBased on these concerns, I recommend either:\n\n- Substantial revision of the theorem statements, claims, and proofs, along with review of potentially overclaimed statements (e.g., lines 11, 12, 66).\n- Removal of the theoretical claims entirely.\n\n**Minor Comments**\n\n- Line 115: Missing braces {}.\n- The notation V_{x_i} and V_θ(x_i) are used inconsistently throughout the text (e.g., around line 131) and should be unified.\n- In Algorithm 1, the model parameter θ may be missing from the input and output specifications.\n\nQUESTIONS:\nI find the proposed method and experimental results satisfactory and believe they contribute meaningfully to the field. These contributions would be valuable even without theoretical guarantees. However, as noted in the weaknesses section, I am concerned that the paper contains clear errors or overclaiming in its theoretical analysis, which could mislead readers. If the authors provide a clear commitment to addressing these theoretical issues, I would be willing to raise my rating to Accept.\n\nLIMITATIONS:\nYes, but the authors addressed only a few in the checklist.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Vulnerable Data-aware Adversarial Training (VDAT), a novel approach to fast adversarial training (FAT) by focusing on sample-wise data filtering rather than the traditional batch-wise methods, which can improve natural accuracy and adversarial accuracy while reducing adversarial training cost.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- (S1) The paper addresses the critical problem of the high computational cost of adversarial training. The proposed VDAT method offers a solution that not only achieves a remarkable speedup (up to 76% efficiency improvement)  but also improves the final model's natural and adversarial accuracy. \n- (S2) The paper is exceptionally well-written and clearly structured.\nWeakness:\n- (W1) This paper has a strong experimental evaluation. However, the study could be further strengthened by incorporating adversarial training experiments on larger-scale datasets, as the benefits of the proposed algorithm may diminish in such scenarios.\n- (W2) Additional experiments and analyses would be beneficial to better understand the algorithm's performance characteristics, particularly regarding how its effectiveness varies with different attack methods for vulnerability assessment.\n\nQUESTIONS:\n1. Could you please explain the significant accuracy improvement observed around epoch 100 in Figure 4?\n2. Could you please explain why VDAT_FGSM generally performs better than VDAT_SGD on both natural accuracy and adversarial accuracy? This seems a bit counterintuitive to me, since SGD provides stronger adversarial examples.\n3. The vulnerability calculation relies on an initial perturbation generated by a single-step FGSM attack for efficiency. How sensitive are the results to this choice? Specifically, if a stronger (e.g., PGD) but more costly attack was used to assess vulnerability, would it identify a more correct set of vulnerable samples and lead to a more robust final model, even if the training itself still uses FGSM or PGD?\n4. Scalability to Large Datasets: The paper reports a time complexity of O(n*k). While the proposed algorithm demonstrates feasibility on smaller datasets, its performance on truly large-scale datasets (e.g., ImageNet-21K) remains unclear, as the sample-wise approach may introduce significant computational overhead. Could the authors provide:\n  - Profiling results detailing the actual runtime breakdown (e.g., percentage of time spent on vulnerability calculation vs. model training)   \n  - Empirical or simulated training overhead analysis to demonstrate how the method would scale to larger datasets.\n\nLIMITATIONS:\nNo. See the contents in Questions.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors introduce vulnerable data-aware adversarial training (VDAT) to improve the efficiency and effectiveness of fast adversarial training (FAT). The authors measure the vulnerability by computing the difference of decision margin for clean and adversarial examples, and then update the clean and adversarial training dataset by using adversarial examples of vulnerable examples in the training process. Extensive experiments validate the effectiveness of the proposed approach in different tasks, datasets and models.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. The proposed approach is clear elaborated with detailed procedure for each step of adversarial training, ensuring the reproducibility.\n2. The paper focus on the critical issue in adversarial training, and propose an effective measurement for vulnerability of adversarial examples.\n3. Extensive experiments are conducted through various tasks, datasets and models, and consistent improvement is achieved in all the experiments, validating the effectiveness of the proposed method. \n\nWeaknesses:\n\n1. The effectiveness of the proposed margin-based vulnerability calculation compared with other measurement is not fully explored by experimental results.\n2. The proposed VDAT seems to be a plug-and-play method in multiple adversarial training frameworks. However, there lacks experiments for combining VDAT with other frameworks like AWP, TRADES and etc.\n\nQUESTIONS:\n1. What are the performance when replacing the vulnerability calculation, e.g. using the pure margin, or changing the margin calculation?\n2. Can the proposed VDAT combine with other multi-step or single-step adversarial training frameworks like AWP and TRADES and further improve their performance?\n3. Can the proposed method be extended to other tasks apart from image classification? If so, how to measure the vulnerability and design the data filtering approach?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes modifying fast adversarial training (FAT) methods by making it more probable to train on adversarial examples for vulnerable training examples, creating vulnerable data-aware adversarial training (VDAT). The vulnerability of a training example is evaluated by computing the difference between the margin between the clean training example and the decision boundary and the margin between a generated adversarial example and the decision boundary. In order to have this margin account for decision boundaries for multiple classes, the paper proposes a soft margin. The probability of training on a generated adversarial example is then computed, with adversarial examples corresponding to training examples that are more vulnerable than average being more likely to be selected for use for a training parameter update. Experiments on CIFAR-10, CIFAR-100, and ImageNet-1K show that the proposed method outperforms previous methods in both natural accuracy and robust accuracy. Additional evidence for the quality of the proposed method is given by showing that combining it with neural architecture search (NAS) also leads to performance improvement.\n\nSTRENGTHS AND WEAKNESSES:\nQuality: This paper seems to be technically sound and the proposed methods appear to be properly applied. The claims seem to be supported by the experimental results. \n\nClarity: The paper is clear.\n\nSignificance: The proposed method is of interest to those that want to use adversarial training for developing more robust networks.\n\nOriginality: The proposed method is, to my knowledge, novel.\n\nQUESTIONS:\nLine 174: Should R(0,1) denote a uniform random value ranged from zero to one?\n\nWhat do the authors see as the value added by Proposition 4.2?\n\nLIMITATIONS:\nThe big limitation of the method appears to be that it slows down FAT. This is discussed in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}