Search papers, labs, and topics across Lattice.
This paper addresses the challenge of multi-threat robustness in deep learning by introducing Threat-aware Frequency Decoupling (TaFD), a two-stage defense framework that reformulates joint adversarial training (JAT) as a frequency-domain approach. By utilizing first-order gradient analysis, the authors identify gradient incompatibility caused by heterogeneous attacks and propose a method that employs unsupervised clustering to identify latent threat domains, allowing for tailored defenses. Experimental results on CIFAR-10, CIFAR-100, and Tiny-ImageNet show that TaFD improves average robust accuracy by approximately 11% over the strongest baseline while preserving leading clean accuracy.
TaFD achieves an 11% boost in robust accuracy against diverse adversarial attacks by leveraging frequency-domain insights and tailored defenses.
Multi-threat robustness remains a fundamental challenge in deep learning. Although joint adversarial training (JAT) is widely adopted, it suffers from negative transfer under heterogeneous threats, particularly between $\ell_p$-bounded and semantic attacks. Through first-order gradient analysis, we formalize this as gradient incompatibility and theoretically establish the necessity of decoupled optimization. We further reveal that these conflicting threats exhibit separable spectral characteristics in the frequency domain. Motivated by this observation, we propose Threat-aware Frequency Decoupling (TaFD), a two-stage defense framework that reformulates JAT as a frequency-domain divide-and-conquer paradigm. TaFD first discovers latent threat domains via unsupervised clustering of attack spectral prototypes and trains a lightweight classifier for inference-time threat domain identification. Conditioned on the prediction, TaFD employs a Frequency-Conditional Convolution that learns threat-domain-specific spectral masks and routes each sample to the corresponding expert, enforcing structural parameter separation and alleviating optimization conflicts. We validate TaFD on three representative image-classification benchmarks (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and on two representative architectures (the convolutional ResNet and the hybrid-transformer MobileViT). Extensive results demonstrate that TaFD achieves more balanced robustness against heterogeneous attacks than existing JAT and frequency-domain baselines, improving average robust accuracy by approximately 11\% over the strongest baseline while maintaining leading clean accuracy.
