Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Probabilistic Adversarial Training (PAT) by framing adversarial examples as the overlap between distance-based and classifier-induced distributions. By maximizing a KL divergence-based lower bound on probabilistic robustness, PAT effectively pushes these distributions apart, leading to improved adversarial robustness. Experiments demonstrate consistent gains in probabilistic robustness, with ablation studies showing the scaling factor can even enhance existing adversarial training methods.
Adversarial training gains a principled probabilistic interpretation and improved robustness via KL divergence maximization, outperforming standard methods.
Building on a probabilistic perspective in which adversarial examples arise from the overlap between a distance-based distribution $p_{\mathrm{dis}}$ and a victim-classifier-induced distribution $p_{\mathrm{vic}}$, we start from a simple intuition: adversarial examples become harder to generate when these two distributions are pushed apart, as their overlap becomes smaller, thereby increasing robustness. This intuition naturally motivates a KL-based robustness objective. We then prove that $\mathrm{KL}(p_{\mathrm{dis}}\|p_{\mathrm{vic}})-\log Z_{\mathrm{vic}}$ is a lower bound on probabilistic robustness (PR), where $Z_{\mathrm{vic}}$ denotes the normalizing constant of $p_{\mathrm{vic}}$. Since PR is generally intractable to compute directly, maximizing this KL-based lower bound provides a tractable surrogate objective for improving PR. We further show that this objective recovers a scaled form of adversarial training, offering a probabilistic interpretation of adversarial training and a principled route to robustness improvement. We call the resulting method probabilistic adversarial training. Experiments show that it consistently improves PR, and ablation studies demonstrate that the induced scaling factor can even enhance the PR of non-probabilistic adversarial training methods.