只对关键样本生成对抗样本，效率提升50%仍保持强鲁棒性
Scaling Adversarial Training via Data Selection
- 按决策边界距离和梯度方向选择关键样本，减少冗余计算
- 在MNIST和CIFAR-10上达到或超过全量PGD的鲁棒性
- 适合需要高效训练对抗鲁棒模型的研究与工程场景
投影梯度下降（PGD）是广泛使用的强对抗攻击方法，但其计算成本高，因所有训练样本均经历相同迭代优化，贡献却不均。为解决此效率问题，我们提出选择性对抗训练，仅在每个小批量中扰动关键样本。具体提出两种原理性选择标准：(1) 基于边距采样，优先选择靠近决策边界的样本；(2) 梯度匹配采样，选择梯度与批次主要优化方向一致的样本。对抗样本仅针对选中的子集生成，其余样本以混合目标干净训练。在MNIST和CIFAR-10上的实验表明，该方法在对抗计算量降低最高50%的前提下，实现与甚至超越完整PGD对抗训练的鲁棒性，证明有策略的样本选择足以实现可扩展的对抗鲁棒性。
原文摘要 · Abstract (English)
Projected Gradient Descent (PGD) is a strong and widely used first-order adversarial attack, yet its computational cost scales poorly, as all training samples undergo identical iterative inner-loop optimization despite contributing unequally to robustness. Motivated by this inefficiency, we propose \emph{Selective Adversarial Training}, which perturbs only a subset of critical samples in each minibatch. Specifically, we introduce two principled selection criteria: (1) margin-based sampling, which prioritizes samples near the decision boundary, and (2) gradient-matching sampling, which selects samples whose gradients align with the dominant batch optimization direction. Adversarial examples are generated only for the selected subset, while the remaining samples are trained cleanly using a mixed objective. Experiments on MNIST and CIFAR-10 show that the proposed methods achieve robustness comparable to, or even exceeding, full PGD adversarial training, while reducing adversarial computation by up to $50\%$, demonstrating that informed sample selection is sufficient for scalable adversarial robustness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。