Fast Adversarial Training against Sparse Attacks Requires Loss Smoothing
adversarial robustness;sparse attack;fast adversarial training
Yes
N/A
No ethics review needed.
1.	Can Fast-LS-$l_0$ be adapted for other sparse attacks, such as those bounded by $L_1$?
2.	Does the trade-off loss function parameter $\alpha$ need to be adjusted across different datasets and tasks?
3.	Could you further elaborate on the necessity of adversarial training under the $L_0$ constraint?
1.	Research on FAT under $L_0$ norm constraints is relatively limited, and the authors address this gap by proposing an innovative method to mitigate performance degradation and catastrophic overfitting in FAT.

2.	The authors provide detailed theoretical insights into the connection between the non-smooth adversarial loss landscape and catastrophic overfitting, giving clarity to the existing issues from the theoretical perspective.

3.	The paper is well-organized and clearly explained, and extensive experiments across diverse datasets validate the robustness of the proposed method.
This paper investigates FAT against sparse adversarial perturbations bounded by the $L_0$ norm, highlighting the challenges associated with FAT, including performance degradation and catastrophic overfitting phenomenon. The authors propose Fast-LS-$l_0$, which incorporates soft labels and a trade-off loss function to smooth the adversarial loss landscape. Experimental results show the effectiveness of the proposed method against sparse attacks.
1.	The novelty is somewhat limited, as many techniques, including soft labels and TRADES loss, are widely used in adversarial defense. The overall method may appear as a straightforward integration of existing techniques.
2.	The application scenario is not clearly defined, particularly why robustness under the $L_0$ norm constraint is essential. Can this adversarial training effectively enhance defense against one-pixel attacks?
3.	The application scenario is unclear, and it is unclear why the model needs to be more robust under the $L_0$ norm constraint. Can this adversarial training enhance the defense capability under the one-pixel attack? 
4.	Whilemost current methods are based on $L_{\infty}$ norm constraints, the author should show the performance of these methods under $L_0$ constraints, such as FAST-GA[1], FAST-BAT[2], FAST-PCO[3].

[1]. Andriushchenko, M. et.al “Understanding and improving fast adversarial training” NIPS, 2020  
[2]. Zhang Y. et.al “Revisiting and advancing fast adversarial training through the lens of bi-level optimization” PMLR, 2022  
[3]. Wang Z. et.al “Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspective” ECCV, 2024
Yes
No ethics review needed.
Please find above.
1. The presentation is easy to follow
2. The proposed method is well-motivated.
3. The experimental results verify the effectiveness of the proposed method in mitigating catastrophic overfitting in $\ell_0$ fast AT.
This work studies the fast adversarial training, usually the single-step adversarial training (AT), in the setting of $\ell_0$-bounded sparse adversarial perturbation. It first identifies the phenomenon of catastrophic overfitting in $\ell_0$ fast AT and the accounts for it, sub-optimal perturbation locations and non-smoothness of the loss landscape. It then proposes to incorporate soft label and trade-off loss function into $\ell_0$ fast AT to smooth loss landscape to mitigate catastrophic overfitting.
1. The studied problem, catastrophic overfitting in $\ell_0$ fast AT, is quite narrow. It considers a very specific case, $\ell_0$, of the $\ell_p$ adversarial setting. The impact of this work's conclusions on the entire field, adversarial machine learning, is therefore limited.
2. The analytical framework and the findings are similar to the existing works of analyzing overfitting in AT. Some of them are already cited in this work, while some else are missing. For example, [1] also attributes overfitting in AT to the degradation of training adversary and the complication of loss landscape throughout training, and proposes to integrate loss landscape smooth techniques into AT to mitigate overfitting. However, I acknowledge that some conlcusion of this work, like the one about sub-optimal perturbation location, seems to be unique to the setting of $\ell_0$ and useful.  
3. The mitigation methods, soft label and trade-off loss function, are proposed by the exiting works, so the methodological contribution of this work is the discovery of the effectiveness of existing methods in mitigating catastrophic overfitting in $\ell_0$ fast AT, but not something novel like proposing a new method. However, as mentioned in Weakness 2, the idea of mitigating overfitting in AT through loss smoothing has been already explored in the existing works, despite that different smoothing techniques are employed.

[1] Li, Lin, and Michael Spratling. "Understanding and combating robust overfitting via input loss landscape analysis and regularization." Pattern Recognition 136 (2023): 109229.
Yes
No ethics review needed.
Refer to weakness.
This work is the first to investigate fast adversarial training in the context of $L_0$ bounded perturbations.

The authors successfully demonstrate that the CO issue in the $L_0$ norm is caused by sub-optimal perturbation locations,  rather than sub-optimal perturbation magnitudes via some interesting ablation studies.

This study conducts extensive experiments, including ImageNet and Transformer-based architectures.
This paper explores the challenges and solutions for catastrophic overfitting within 1-step adversarial training targeted at sparse adversarial perturbations bounded by the  $L_0$  norm. 
Through a comprehensive analysis, the authors illustrate that the CO issue in $L_0$ norm stems from a more craggy loss landscape compared to its $L_{\infty}$,  $L_2$, and  $L_1$ counterparts.
To address these challenges, the authors propose incorporating soft labels and a trade-off loss function, strategies specifically designed to smooth the adversarial loss landscape associated with $ L_0$  norm 1-step adversarial training.
Theoretical analysis indicates that large $\left\|\boldsymbol{\delta}_1-\boldsymbol{\delta}_2\right\|$ can intensify the gradient discontinuity, and  $L_0$ norm has the largest upper bound. 
However, directly comparing these upper bounds may not be a fair comparison due to the naturally larger freedom in change magnitudes associated with the $L_0$  norm. 
Could authors provide some empirical results of $\left\|\boldsymbol{\delta}_1-\boldsymbol{\delta}_2\right\|$ among different norms to support their claim?

It would be interesting to examine the performance of Expectation over Transformation (EOT) [1] and Backward Pass Differentiable Approximation (BPDA) [1] on the authors’ proposed method, which can effectively exclude gradient masking in 1-step adversarial training.

Recent advances in addressing CO by preventing loss landscape distortion with other norms [2,3,4,5] may also prove beneficial in alleviating CO in the $L_0$ norm and should be discussed.

[1] Athalye, A., Carlini, N., & Wagner, D. (2018, July). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning (pp. 274-283). PMLR.\
[2] Grabinski, J., Jung, S., Keuper, J., & Keuper, M. (2022, October). Frequencylowcut pooling-plug and play against catastrophic overfitting. In European Conference on Computer Vision (pp. 36-57). Cham: Springer Nature Switzerland.\
[3] Lin, R., Yu, C., & Liu, T. (2024). Eliminating catastrophic overfitting via abnormal adversarial examples regularization. Advances in Neural Information Processing Systems, 36.\
[4] Rocamora, E. A., Liu, F., Chrysos, G., Olmos, P. M., & Cevher, V. Efficient local linearity regularization to overcome catastrophic overfitting. In The Twelfth International Conference on Learning Representations.\
[5] Lin, R., Yu, C., Han, B., Su, H., & Liu, T. Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependency. In Forty-first International Conference on Machine Learning.
@inproceedings{
anonymous2024fast,
title={Fast Adversarial Training against Sparse Attacks Requires Loss Smoothing},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=NlEt8LYAxC},
note={under review}
}
This paper studies fast adversarial training against sparse adversarial perturbations. We highlight the challenges faced when employing $1$-step attacks on $l_0$ bounded perturbations for fast adversarial training, including degraded performance and the occurrence of catastrophic overfitting (CO). We highlight that CO in $l_0$ adversarial training is caused by sub-optimal perturbation locations of $1$-step attack, which is distinct from other cases. Theoretical and empirical analyses reveal that the loss landscape of $l_0$ adversarial training is more craggy compared to its $l_\infty$, $l_2$ and $l_1$ counterparts. Moreover, we corroborate that the craggy loss landscape can aggravate CO. To address these issues, we propose Fast-LS-$l_0$ that incorporates soft label and the trade-off loss function to smooth the adversarial loss landscape. Extensive experiments demonstrate our method can overcome the challenge of catastrophic overfitting, achieves state-of-the-art performance and narrows down the performance gap between $1$-step and multi-step adversarial training against sparse attacks.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
adversarial robustness sparse attack fast adversarial training
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/ff5c8a22e1f4949d7c742a71083766af670a6ac5.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
/attachment/cb283e83c12ee76a2616bc6ae0651e1c033883cb.zip
Fast Adversarial Training against Sparse Attacks Requires Loss Smoothing
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission